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400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202 


February  14,  2000 

MEMORANDUM  FOR  DIRECTOR,  DEFENSE  INTELLIGENCE  AGENCY 

SUBJECT:  Evaluation  Report  on  Office  of  the  Inspector  General,  Defense  Intelligence 
Agency  (Report  No.  D-2000-6-003) 


We  are  providing  this  report  for  information  and  use.  We  conducted  the 
evaluation  to  assess  the  effectiveness  of  the  Office  of  the  Inspector  General,  Defense 
Intelligence  Agency,  in  response  to  your  memorandum  of  August  13,  1998,  and  to 
fulfill  Government  Auditing  Standards  that  require  an  external  quality  control  review  of 
organizations  conducting  audits  at  least  once  every  3  years.  We  considered 
management  comments  on  the  draft  of  this  report  when  preparing  the  final  report. 

Comments  on  the  draft  of  this  report  conformed  to  the  requirements  of  DoD 
Directive  7650.3  and  left  no  unresolved  issues.  Therefore,  no  additional  comments  are 
required. 

We  appreciate  the  courtesies  extended  to  the  evaluation  staff.  Questions  on  the 
report  should  be  directed  to  Mr.  Wayne  C.  Berry  at  (703)  604-8789  (DSN  664-8789) 
(wberry@dodig.osd.mil)  or  Mr.  Bruce  Drucker  at  (703)  604-8773  (DSN  664-8773) 
(bdrucker@dodig.osd.mil).  See  Appendix  D  for  the  report  distribution.  The 
evaluation  team  members  are  listed  inside  the  back  cover. 


Robert  J.  Lieberman 
Assistant  Inspector  General 
for  Auditing 
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Report  No.  D-2000-6-003 

(Project  No.  80C-9020) 


February  14,  2000 


Office  of  the  Inspector  General, 
Defense  Intelligence  Agency 

Executive  Summary 


Introduction.  The  Director,  Defense  Intelligence  Agency  (DIA),  established  the 
administrative  (nonstatutory)  Office  of  Inspector  General  (GIG)  in  1991.  The  OIG, 
DIA,  conducts  independent  audits,  inspections,  and  investigations  of  DIA  programs  that 
are  critically  linked  to  national  security.  The  Director,  DIA,  requested  a  review  of  the 
OIG,  DIA,  because  of  complaints  to  him  regarding  various  aspects  of  the  OIG,  DIA, 
working  environment. 

Objectives.  The  primary  objective  was  to  evaluate  allegations  concerning  the  working 
environment  within  the  OIG,  DIA.  In  addition,  the  overall  independence  of  the  OIG, 
DIA,  was  evaluated.  Part  of  the  evaluation  was  to  determine  whether  resources  were 
managed  effectively.  A  quality  control  review  was  also  performed  to  examine 
compliance  by  the  audit  division  with  applicable  standards.  The  evaluation  included  a 
review  of  the  management  control  program,  as  applicable  to  the  stated  objectives.  The 
management  and  effectiveness  of  the  investigative  mission  was  also  evaluated. 

Results.  The  allegations  of  a  poor  working  environment  were  unsubstantiated  (finding 
A).  However,  there  were  shortfalls  related  to  organizational  structure,  planning, 
independence  in  selecting  senior  management,  and  management  controls  (finding  B). 
The  OIG,  DIA,  had  designed  a  comprehensive  quality  control  system;  however,  it  had 
not  always  been  effectively  applied.  As  a  result,  compliance  with  standards  for  staff 
qualifications,  independent  review,  field  work  and  reporting  needed  improvement 
(finding  C).  Investigators  were  classified  in  the  1811,  Criminal  Investigating  series, 
although  the  vast  majority  of  investigations  were  administrative  in  nature.  Typical 
criminal  investigative  management  processes,  policies,  and  procedures  were  absent,  and 
potential  criminal  cases  were  not  always  coordinated  with  the  appropriate,  responsible 
agencies.  Viewed  as  administrative  investigations,  however,  the  casework  was  sound 
(finding  D). 

Summary  of  Recommendations.  We  recommend  that  the  Director,  DIA,  establish 
procedures  according  to  our  memorandum  dated  July  3,  1997,  on  the  management  of 
any  request  to  involve  the  OIG  in  operational  tasks;  terminate  the  involvement  of  the 
OIG,  DIA,  in  the  approval  process  for  acquisitions  and  require  periodic  audit  of  the 
acquisition  procedures;  provide  for  a  separate  operating  budget  for  the  OIG,  DIA,  and 
give  the  Inspector  General  sole  authority  over  managing  their  appropriated  funds;  and 
direct  that  other  procedures  be  developed  to  define  and  enhance  the  independent  role  of 
the  Office  of  Inspector  General. 
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We  recommend  that  the  Inspector  General,  DIA,  provide  training  on  audit  working 
papers  and  the  auditor  responsibility  to  detect  fraud;  provide  guidance  on  supervision; 
improve  the  planning  process;  and  develop  management  controls  and  guidance  for 
assessing  DIA  units  management  controls.  We  also  recommend  that  the  Inspector 
General  reassess  the  need  for  the  1811,  Criminal  Investigating  series;  develop  a 
proactive  investigative  program  that  prioritizes  and  schedules  cases,  and  includes 
procedures  to  coordinate  with  appropriate  investigative  organization. 

Management  Comments.  The  Director  and  Inspector  General,  Defense  Intelligence 
Agency,  concurred  fully  or  in  part  with  all  recommendations.  Their  planned  actions 
are  responsive  to  the  intent  of  the  recommendations.  Management  comments  are 
discussed  in  the  Findings  section  of  the  report  and  the  complete  text  of  management 
comments  is  in  the  Management  Comments  section. 
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Background 


The  Defense  Intelligence  Agency  (DIA)  established  a  nonstatutory  Office  of 
Inspector  General  (01 G)  in  1991.  The  OIG,  DIA,  was  established  to: 

•  conduct  and  supervise  independent  and  objective  audits,  inspections, 
and  investigations  relating  to  DIA  programs  and  operations; 

•  promote  economy,  effectiveness,  and  efficiency  within  the  DIA; 

•  prevent  and  detect  fraud,  waste,  and  abuse  in  DIA  programs  and 
operations; 

•  review  and  make  recommendations  regarding  existing  and  proposed 
legislation  and  regulations  relating  to  DIA  programs  and  operations; 
and, 

•  keep  the  Director,  DIA,  fully  and  currently  informed  of  problems  in 
DIA  programs  and  operations. 

According  to  DoD  Directive  5105.21,  “Defense  Intelligence  Agency  (DIA),” 
February  18,  1997,  the  “DIA  shall  satisfy,  or  ensure  the  satisfaction  of,  the 
military  and  military-related  intelligence  requirements .  .  .  and  provide  the 
military  intelligence  contribution  to  national  foreign  intelligence  and 
counterintelligence.”  At  the  beginning  of  FY  1996,  the  DIA  absorbed  certain 
intelligence  responsibilities  from  all  the  Services  to  centralize  management, 
significantly  increasing  its  operational  activity  and  human  resources.  To 
accomplish  the  oversight  of  the  DIA  mission,  DIA  regulations  provide  for  the 
OIG,  DIA,  independence  and  require  it  to  follow  the  directives  of  DoD. 

Requirement  for  Reports  to  Congress.  An  unclassified  Senate  report 
accompanying  Senate  bill  1009,  the  Intelligence  Authorization  Act  for  FY  2000, 
May  11,  1999,  expressed  concern  about  the  oversight  capabilities  of  the 
administrative  (nonstatutory)  01  Gs  within  the  intelligence  community.  The 
concern  was  prompted  by  the  report,  “Joint  Quality  Control  Review  of  the  Office 
of  Inspector  General  at  the  National  Reconnaissance  Office,”  December  22,  1998, 
performed  by  the  OIG,  DoD,  and  the  OIG,  Central  Intelligence  Agency.  The 
Senate  report  proposes  that  the  OIG,  DIA,  and  all  other  administrative  OIGs  in 
the  intelligence  community  provide  an  annual  report  that  details  the  resources 
requested,  the  plan  for  their  use  outlining  scheduled  programs  and  activities,  their 
ability  to  hire  and  retain  the  qualified  personnel,  and  any  other  OIG  concerns. 


Objectives 


We  assessed  two  anonymous  allegations  that  were  documented  concerning  the 
working  climate  in  the  OIG,  DIA.  We  also  evaluated  the  overall  independence  of 
the  OIG,  DIA,  and  its  resource  management.  An  external  quality  control  review, 
required  at  least  once  every  3  years  for  organizations  conducting  audits  according 
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to  government  auditing  standards,  was  performed  to  examine  whether  the  audit 
division  complied  with  applicable  standards.  The  external  quality  control  review 
of  the  audit  division  addresses  the  areas  of  auditor  qualifications;  independence; 
due  professional  care;  quality  control  procedures;  audit  planning;  supervision; 
working  papers;  management  controls;  indications  of  illegal  acts,  abuse,  and 
noncompliance;  and  reporting  of  audit  results.  The  evaluation  included  a  review 
of  the  management  control  program,  as  applicable  to  the  stated  objectives.  See 
Appendix  A  for  a  discussion  of  the  evaluation  scope  and  methodology,  and  the 
review  of  the  management  control  program. 
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A.  Anonymous  Allegations 

The  Director,  DIA,  (hereafter  referred  to  as  "the  Director")  indicated  to 
the  Inspector  General,  DoD,  on  August  13,  1998,  that  he  had  received 
numerous  anonymous  letters  that  commented  on  “the  poor  working 
environment”  at  the  OIG,  DIA.  We  reviewed  the  two  specific  allegations 
for  which  supporting  evidence  was  available.  Our  review  did  not 
substantiate  the  allegations  or  the  existence  of  a  poor  working  environment 
within  the  OIG,  DIA. 

Documentation  and  Substantiation  of  Allegations 


On  September  21,  1998,  the  Director  was  requested  to  provide  documentation 
related  to  the  anonymous  allegations,  referred  to  in  his  request.  The  DIA 
command  element,  including  the  Director,  Deputy  Director,  and  their  individual 
staffs,  had  not  retained  any  complaint-related  documentation.  Our  followup  with 
personnel  recommended  by  the  Director  similarly  did  not  disclose  additional 
complaints  or  allegations. 

The  IG,  DIA,  was  the  only  DIA  official  who  was  able  to  provide  specific 
information  on  the  complaints.  The  IG,  DIA,  had  been  provided  with  the  details 
of  two  complaints  made  to  the  Director;  one,  a  hand-written  allegation  in  the  form 
of  a  letter,  and  the  other,  a  personal  account  of  an  undocumented  allegation.  The 
hand-written  allegation  indicated  that  the  OIG,  DIA,  employees  were  “voting  with 
their  feet”  (resigning  from  the  OIG)  because  of  the  leadership  style  of  the  IG, 
DIA.  The  IG,  DIA,  described  the  undocumented  complaint  as  alleging 
discriminatory  practices  on  his  part.  The  IG,  DIA,  stated  that  he  met  individually 
with  the  staff  to  determine  whether  there  was  any  real  or  perceived  indication  that 
the  allegations  were  true,  but  no  one  recorded  any  concerns.  We  interviewed  the 
personnel  affected  by  the  allegations;  those  leaving  or  having  left  the  OIG,  DIA; 
and  those  of  minority  heritage  (primarily  African-American).  All  personnel 
interviewed  verified  that  the  IG,  DIA,  had  discussed  the  matter  with  them. 

Our  interviews  did  not  substantiate  either  of  the  allegations  and  no  similar, 
additional  allegations  were  made  to  us  during  our  review. 
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B.  Resource  Management 

Several  resource  management  issues  required  management  attention.  The 
OIG,  DIA,  organizational  structure  as  of  February  1999  included  an 
excessive  span  of  control  for  the  Deputy  Inspector  General  for  Audits  and 
Inspections  (DIGAI).  The  annual  plans  of  the  OIG,  DIA,  have  been 
unrealistic  considering  the  resources  available  to  accomplish  those  plans. 
The  procedures  used  to  select  the  DIGAI  in  April  1998  did  not  recognize 
the  need  to  safeguard  IG,  DIA  independence.  The  OIG,  DIA,  had  not 
developed  an  adequate  management  control  self-assessment  program. 
These  issues  need  to  be  addressed  in  order  to  better  assure  effective  and 
efficient  operations. 


Standards,  Directives,  and  Regulations 


DIA  Regulations.  The  DIA  Regulation  No.  40-5,  “Inspector  General,  Policies 
and  Responsibilities,”  October  15,  1991,  indicates  that  the  OIG  will  be  provided 
its  resources  according  to  applicable  DIA  regulations,  and  the  OIG  personnel  will 
be  subject  to  applicable  DIA  personnel  regulations.  The  DIA  Regulation 
No.  49-5,  “Manpower  and  Organization,”  October  8,  1990,  provides  guidance 
for  supervisory  evaluation  showing  that  if  a  supervisory  ratio  of  one  supervisor  to 
eight  subordinates  exists,  the  span  of  control  may  be  burdened  with  more 
subordinates  than  can  be  effectively  managed.  The  DIA  Regulation  41-1,  “Audit 
and  Internal  Controls  -  Management  Control  Program,”  December  13,  1996, 
establishes  policies  and  procedures  for  execution  of  the  management  control 
program  at  DIA.  The  regulation  applies  to  all  DIA  organizations  and  must  be 
reviewed  by  all  agency  managers  for  its  policies,  definitions,  responsibilities,  and 
reporting  requirements. 

OIG,  DIA,  Standard  Operating  Procedure  97-01,  “Audit  Procedures  and 
Report  Quality  Control  Program,”  January  10, 1997.  The  manual  contains  the 
procedures  for  the  annual  audit  planning  process  and  provides  for  a  plan  that  is  to 
be  consistent  with  the  available  audit  resources.  When  the  annual  audit  plan  has 
been  completed,  the  OIG  is  to  discuss  and  review  the  plan  with  the  Director  and 
discuss  pertinent  portions  of  the  plan  with  other  DIA  senior  representatives  to  be 
affected  by  the  plan.  The  procedures  show  that  the  minimum  information  to  be  in 
the  annual  audit  plan  are  justifications  for  the  proposed  audits,  audit  objectives, 
and  the  activities  and  locations  to  be  included  in  the  audit. 

Organizational  Structure 


The  authorized  staff  levels  for  each  of  the  disciplines-audits,  inspections,  and 
investigations-remained  fairly  constant  from  FY  1996  through  FY  1998.  As  of 
July  1999,  the  OIG,  DIA,  had  an  authorized  staff  of  38  (compared  to  41  in 
FY  1996)  and  an  on-board  staff  of  31.  For  the  period  covered  by  this  evaluation, 
the  level  of  output  for  each  oversight  function  is  depicted  by  the  following 
completed  projects  and  cases; 
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Audit  Projects 

FY1996 

6 

FY1997 

9 

FY1998 

5 

Inspection  Projects 

13 

21 

13 

Investigations  Cases 

223 

284 

214 

Intelligence  Oversight  Cases 

N/A 

6 

7 

The  DIGAI,  one  of  the  three  Deputy  Inspectors  General  (DIG)  for  the  OIG,  DIA, 
managed  25  auditor  and  inspector  positions  (in  excess  of  80  percent  of  the  31 
oversight  positions)  and  was  responsible  for  the  majority  of  the  projected  program 
plan.  See  Appendix  B  for  the  organizational  chart  of  the  OIG,  DIA  as  of 
February  1999,  which  showed  the  majority  of  the  staff  reporting  directly  to  the 
DIGAI.  The  dual-hatted  DIGAl  emerged  in  January  1998  when  the  billet  for  the 
previous  position  of  the  Assistant  Inspector  General  (AIG)  for  Inspections  was 
eliminated  by  the  Director,  To  partially  accommodate  the  loss  of  the  AIG 
position,  an  oversight  staff  member  in  audit  and  in  inspections  was  assigned 
program  management  duties  that  the  previous  AIGs  for  Audits  and  for  Inspections 
lad  performed  separately. 

To  assist  with  organizational  arrangements,  the  DIA  Regulation  No.  49-5, 
provides  guidance  for  the  ratio  of  supervisor  to  subordinates.  Enclosure  1  of  DIA 
Regulation  No.  49-5  shows  that  more  than  eight  subordinates  per  supervisor  may 
be  ineffective  and  should  be  “evaluated  based  on  the  nature,  complexity,  and 
disparity  of  the  functions  (i.e.,  mission)  of  the  organization  element.”  The  DIA 
Regulation  No.  49-5  applies  to  the  OIG,  DIA,  and  particularly  the  DIGAI  sub¬ 
organization.  An  evaluation  needs  to  be  performed  of  the  supervisory  ratio  to 
provide  the  OIG,  DIA,  with  an  effective  organizational  structure.  We  regard  the 
DIGAI  span  of  control  (25  individuals)  as  excessive  and  not  conducive  to  proper 
supervisory  control. 

Realistic  Planning 


The  OIG,  DIA,  planning  process  includes  consideration  of  the  auditable  and 
inspectable  entities.  However,  the  implementation  and  management  of  the 
planning  process  and  its  successful  outcome  could  be  improved.  The  OIG,  DIA, 
has  not  effectively  used  planning  tools  and  regulations  to  prepare  a  realistic  annual 
plan  and  defend  its  resource  needs  throughout  the  year  to  accomplish  the  plan. 
Without  adequate  resources  and  supervision,  the  unachievable  annual  plan  results 
in  lengthy  audits  and  the  dropping  of  proposed  audit  projects  targeted  at  problem 
areas  or  high  risk. 

Each  year,  the  distribution  memorandum  for  the  OIG,  DIA,  annual  plan  to  the  top 
management  of  DIA  components  shows  the  Director's  endorsement  of  the  plan. 
Much  of  the  plan,  particularly  pertaining  to  the  audit  topics,  is  "the  direct  result  of 
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specific  management  requests."  The  OIG,  DIA,  Internal  Audit  Manual  (also 
Standard  Operating  Procedure  97-01),  January  10,  1997,  contains  specific  steps 
for  audit  planning  that  are  “essential  for  the  effective  management  of  an  audit 
organization  and  the  proper  allocation  and  control  of  audit  resources.”  The  OIG, 
DIA,  recounts  the  planning  process  and  its  merits  in  introducing  each  annual  plan 
and  in  establishing  the  DIA  Manual  No.  40-1,  January  30,  1992,  for  dealing  with 
the  OIG,  DIA. 

Despite  the  written  procedures  for  planning  and  managing  their  resources,  the  two 
processes  do  not  match.  The  OIG,  DIA,  historically  has  neither  the  staff  required 
to  accomplish  the  program  plan  nor  the  process  to  show  the  number  of  staff  or 
work  years  required  to  accomplish  the  program  plan.  For  example,  the  FY  1999 
program  plan  is  understaffed  by  68  percent  when  compared  to  the  actual  staff 
available  to  perform  the  planned  effort.  We  converted  the  FY  1999  program  plan 
(developed  during  FY  1998)  with  information  from  the  individuals  in  the  positions 
of  senior  audit  program  manager  and  senior  inspection  program  manager 
regarding  the: 

•  current  status  of  projects  to  be  completed  as  of  January  1999, 

•  approximate  average  number  of  hours  to  accomplish  a  project  based  on 
historical  experience, 

•  number  of  staff  that  were  considered  during  the  planning  process, 

•  current  number  of  staff  available,  and 

•  consideration  for  special  requests,  demands,  and  other  unanticipated 
efforts. 

The  FY  1999  program  plan  converts  to  an  approximated  staff  of  15  auditors,  13 
inspectors,  and  4  investigators.  When  compared  to  the  actual  staff  of  9  auditors, 

8  inspectors,  and  2  investigators  as  of  January  1999,  it  is  apparent  that  the 
program  plan  is  unachievable. 

The  audit  plans  for  FYs  1996  through  1998  show  40  proposed  audit  projects 
compared  to  17  programmed  and  three  non-programmed  audits  that  were 
completed  in  the  same  period.  Of  the  20  completed  audits  (17  programmed  and  3 
non-programmed)  for  FYs  1996  through  1998,  there  were  8  audits  ongoing  for 
more  than  a  year  and  4  ongoing  for  more  than  2  years.  The  remaining  audits 
listed  in  the  audit  plans  were  either  carried  over  to  the  next  FY  audit  plan  or 
dropped  without  explanation,  despite  having  been  coordinated  with  the  Director 
and  DIA  key  components,  and  the  vulnerability  assessment  at  the  time  of  the 
annual  plan  development.  The  planned  audits  that  remain  are  primarily  those  of 
long  duration  and  recurring  requirement  including  audits  required  by  section  433, 
title  10,  United  States  Code  on  intelligence  commercial  activities  (requested  by  the 
Assistant  to  the  Secretary  of  Defense  [Intelligence  Oversight]);  and  audits  required 
by  regulation  addressing  intelligence  contingency  funds,  non-appropriated  funds, 
and  the  Government-wide  purchasing  card.  As  discussed  above,  12  of  20  audit 
projects  carry  over  for  a  year  or  more  due  to  staff  shortages.  The  result  is 
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an  overly  ambitious  plan  that  cannot  be  achieved.  To  keep  the  Director  fully 
informed,  the  OIG,  DIA,  should  measure  the  accomplishment  of  the  annual 
program  plan  at  mid-year  and  explain  any  deviations  from  it. 

Appointment  of  Deputy  Inspector  General  for  Audits  and 
Inspections 

In  April  1998,  the  Director  appointed  the  DIGAI  from  within  the  DIA  ranks  to  fill 
an  existing  vacancy.  At  the  time  of  the  appointment,  the  personnel  office  was 
preparing  a  certificate  of  eligible  applicants  for  consideration  by  the  IG,  DIA. 

The  Director,  DIA,  bypassed  this  process  and  appointed  an  individual,  who  had 
not  submitted  an  application,  to  the  position. 

Based  on  the  interviews  with  the  OIG,  DIA,  employees,  some  auditors, 
inspectors,  managers,  and  others  expressed  concern  with  how  the  DIGAI  selection 
occurred.  We  believe  that  the  IG,  DIA,  should  be  the  selecting  official  for  all 
senior  management  positions  in  the  OIG,  DIA. 

Management  Control  Program 


Management  controls  are  intended  to  safeguard  resources  while  assuring  mission 
accomplishment.  The  formal  policies  and  procedures  for  the  OIG,  DIA,  that 
contain  the  management  controls  are  substantial.  The  Deputy  Inspector  General 
(formerly  the  position  of  Deputy  Inspector  General  for  Management  and 
Administration)  is  currently  responsible  for  maintaining  the  OIG  management 
control  program  (MCP)  and  preparing  the  annual  statement  of  assurance  for  IG 
signature.  The  OIG,  DIA,  evaluation  process  to  assess  the  status  of  its 
management  controls  is  described  in  the  annual  statement  of  assurance  as  “[T]he 
combination  of  the  evaluations  by  external  agencies  and  the  [DIG’s]  own  daily 
awareness  of  the  activities  and  processes .  .  .  .  ”  Beyond  the  annual  reporting 
requirement,  there  are  no  tests  performed  within  the  office  to  determine  the 
adequacy  of  its  management  controls  as  outlined  in  Appendix  A  of  this  report. 
The  OIG,  DIA,  needs  to  develop  an  evaluation  process  and  report  on  the  results 
of  the  evaluation  according  to  the  DIA  Regulation  41-1. 

Summary 


The  ability  of  the  OIG,  DIA,  to  accomplish  its  mission  would  be  enhanced  by 
improvements  to  its  organizational  structure,  a  realistic  match  of  its  resources  and 
annual  plan,  sufficient  IG,  DIA,  authority  to  select  senior  personnel  and  better 
procedures  to  test  its  own  management  controls. 
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Recommendations,  Management  Comments,  and  Evaluation 
Response 

B.l.  We  recommend  that  the  Director,  Defense  Intelligence  Agency,  direct 
that  the  Inspector  General  is  the  selection  authority  and  the  Director  is  the 
approval  authority  for  grade  level  15  positions  to  be  filled  by  hiring, 
reassignment,  or  promotion  to  the  supervisory  or  managerial  role. 

DIA  Comments.  The  DIA  supported  the  intent  of  the  recommendation  and 
indicated  that  current  procedures  allow  for  all  DIA  key  components  to  select  and 
approve  the  GG-15  personnel. 

B.2.  We  recommend  that  the  Inspector  General,  Defense  Intelligence 
Agency: 

a.  Comply  with  Defense  Intelligence  Agency  Reflation  49-5, 
“Manpower  and  Organization,”  October  8,  1990,  in  assessing  the  Office  of 
Inspector  General  organization  on  developing  a  more  effective  supervisor-to- 
subordinate  ratio. 

DIA  Comments.  The  DIA  concurred. 

b.  Clarify  the  planning  procedures  for  the  audit,  inspection,  and 
investigative  functions  to: 

(1)  Identify  the  optimum  level  of  staffing  required  to  effectively 
supervise  and  execute  the  proposed  annual  plan  and  include  the  staff  levels  in 
the  annual  plan. 

(2)  Include  a  practice  to  maintain  a  current  status  of  the 
annual  plan  and  report  mid-year  to  the  Director,  Defense  Intelligence 
Agency,  on  the  status  of  the  annual  plan. 

(3)  Formally  document  at  the  completion  of  each  fiscal  year  an 
assessment  of  actual  performance  compared  to  the  annual  plan  and  provide 
accompanying  explanations  for  the  exceptions  to  the  Director,  Defense 
Intelligence  Agency. 

DIA  Comments.  The  DIA  concurred. 

c.  Implement  a  management  control  self-assessment  process  that 
effectively  addresses  and  tests  the  Office  of  the  Inspector  General,  Defense 
Intelligence  Agency,  management  controls. 

DIA  Comments.  The  DIA  concurred. 
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C.  Results  of  Quality  Control  Review 

The  OIG,  DIA,  quality  control  system  for  the  audit  function,  in  effect  for 
the  fiscal  years  of  1996  through  1998,  was  designed  according  to  the 
quality  standards  established  b^y  the  President’s  Council  on  Integrity  and 
Efficiency.  Although,  the  OIG,  DIA,  had  an  appropriate  quality  control 
system  with  checklists  and  an  independent  reference  review, 
implementation  of  the  quality  control  system  needs  improvement.  For  the 
five  audits  (four  performance  and  one  financial)  tested  for  compliance  with 
the  auditing  standards,  the  checklists  and  independent  reference  reviews 
for  performance  reviews  had  not  been  fully  completed  in  all  areas  to 
ensure  that  all  generally  accepted  government  audit  standards  (GAGAS) 
have  been  followed.  Therefore,  inadequacies  remained  undetected  by  the 
OIG,  DIA,  quality  control  system  in  the  areas  of  due  professional  care, 
audit  planning,  supervision,  working  papers,  management  controls, 
handling  and  reporting  of  fraudulent  matters,  and  audit  reports. 

Adherence  to  Established  Standard  Operating  Procedures  and 
Applicable  Standards 

The  OIG,  DIA,  has  comprehensive  and  formal  standard  operating  procedures 
(SOP)  considering  the  relatively  small  size  of  the  office.  Our  review  of  the 
quality  control  system  confirmed  that  SOP  existed  for  audit  planning, 
performance,  reporting,  quality  control,  supervision,  and  training  in  the  OIG, 
DIA,  internal  audit  manual.  Our  review  of  the  annual  audit  plan;  individual 
auditor  training  records;  auditor  interviews;  the  OIG,  DIA,  completion  of  the 
questionnaire  regarding  its  quality  control  SOP;  and  the  assessment  of  four 
performance  audits  and  one  financial  audit  show  a  need  for  improvement  in 
supervision,  understanding,  and  judgment  in  applying  the  standards.  The  cited 
conditions  for  GAGAS  compliance  form  the  basis  for  our  opinion  that  is 
expressed  at  the  conclusion  of  this  finding. 


Summary  of  Prior  Coverage 

During  the  last  5  years,  the  Inspector  General,  DoD,  issued  one  report  on  a 
quality  control  review.  Report  No.  APO  94-015,  "Report  on  the  External  (Quality 
Control  Review  of  the  Defense  Intelligence  Agency  Inspector  General  Audit 
Organization,"  August  30,  1994.  The  report  contained  findings  regarding  the 
DIA  influence  over  promotion  of  the  OIG  staff  and  the  approval  of  OIG  training, 
the  quality  of  audit  reports  and  working  papers  according  to  GAGAS,  and  the 
timing  of  Individual  Development  Plans  to  be  used  for  the  annual  training  plan. 


General  Standards 

The  general  standards  address  the  areas  of  staff  qualifications,  independence,  due 
professional  care,  and  quality  control. 
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staff  Qualifications.  The  audit  staff  met  the  proficiency  and  continuing 
professional  education  (CPE)  requirements.  GAGAS  3.6  and  DoD  Directive 
7600.2,  “Audit  Policies,”  February  2,  1991,  require  that  auditors  responsible  for 
planning,  directing,  conducting,  or  reporting  on  government  audits  must 
complete,  every  2  years,  at  least  80  hours  of  CPE,  which  contributes  to  the 
auditor’s  professional  proficiency.  At  least  20  hours  should  be  completed  in  any 
one  year  of  the  2-year  period,  and  at  least  24  of  the  80  hours  must  be  in  subjects 
directly  related  to  the  government  environment  and  to  government  auditing.  The 
audit  staff  has  significantly  exceeded  the  CPE  requirement  by  averaging  90  CPE 
hours  per  year  for  FY  1996  through  FY  1998  in  courses  specifically  related  to  the 
government  audit  environment. 

Training  Budget.  The  Joint  Military  Intelligence  Training  Center 
authority  influences  the  independence  of  the  audit  function  by  establishing  the 
OIG,  DIA,  training  budget.  For  example,  the  FY  1999  training  budget,  as 
determined  by  the  Joint  Military  Intelligence  Training  Center,  is  drastically 
reduced  to  approximately  $4,180  (or  $110  per  capita)  from  the  FY  1998  figure  of 
$20,885.  The  budget  gives  no  consideration  to  the  CJAGAS  training  requirement 
or  the  training  requirements  for  other  OIG  disciplines,  that  is,  inspections  and 
investigations.  The  situation  has  required  the  DIGAI  to  justify  and  pursue 
additional  monies  from  DIA  components  that  it  audits.  This  arrangement  hinders 
the  OIG,  DIA,  independence  in  conducting  its  work.  We  are  not  implying  that 
the  OIG,  DIA,  should  maintain  the  levels  of  training  recorded  for  FY  1996 
through  FY  1998.  However,  it  should  be  able  to  meet  the  GAGAS  requirement. 
To  ensure  the  independence  of  the  nonstatutory  OIG,  the  Director  should  establish 
a  separate  line  item  in  the  DIA  budget  for  the  OIG,  DIA. 

Approval  of  Training  Requests.  The  requests  for  training  are  being 
approved  by  the  DIA  Training  Administration  Branch.  In  one  instance,  a  request 
for  approval  of  an  auditor  to  take  a  Certified  Public  Accountant  review  course  was 
disapproved  November  6,  1996,  and  then  later  approved  May  22,  1998,  by  the 
same  DIA  human  resources  employee.  The  original  denial  by  human  resources 
was  explained  as  “Training  is  approved  in  support  of  skills  REQUIRED  of  an 
employee  ....  DIA  does  not  pay  for  professional  development  activities.” 
Regarding  further  interpretation  of  what  constitutes  training,  DIA  Regulation 
24-1,  "Training,"  November  14,  1997,  cites  a  determination  at  Section  12  that 
“meetings,  seminars,  or  conferences”  are  “not  considered  formal  training”  and, 
therefore,  must  be  covered  by  operational  funding.  Applying  the  regulation  to  the 
OIG,  DIA,  is  wrong  and  short-sighted  for  the  training  needs  of  the  auditors  that 
belong  to,  and  can  participate  in,  many  associations  and  institutions  that  have 
“meetings,  seminars,  or  conferences”  qualifying  as  CPE  credit.  Those  controls 
over  the  OIG,  DIA,  affect  its  independence  and  ability  to  efficiently  manage  its 
training  needs.  The  Director  should  establish  not  only  the  separate  budget  line 
item  for  the  OIG,  DIA,  but  also  the  IG  authority  to  approve  training  requests  and 
manage  the  budget  that  includes  the  training  item. 

Individual  Development  Plans.  A  reeommendation  in  the  prior  IG, 

DoD,  report  dealt  with  the  timing  of  the  preparation  of  the  Individual 
Development  Plans  (IDPs)  for  each  auditor’s  training  needs.  In  response  to  the 
recommendation,  a  memorandum  was  issued  by  the  AIG  for  Audits  on  August  9, 
1994,  to  request  that  the  auditors  provide  their  IDPs  by  September  9,  1994,  for 
that  year.  The  SOP  has  not  been  adjusted  to  formally  adopt  the  timing  of  the 
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IDP.  As  a  result,  the  IDPs  for  FY  1996  through  FY  1999  have  been  prepared  in 
late  August  to  late  September,  without  any  consideration  in  preparing  or  justifying 
the  training  budget.  The  IDP  should  serve  as  an  estimating  tool  for  the  OIG 
training  budget  objective.  We  believe  the  IDP  policy  should  be  formally 
established  in  the  OIG  SOP  for  developing  the  training  budget. 

Independence.  The  credibility  of  the  OIG,  DIA,  as  a  source  of  completely 
objective  advice  needs  closer  attention.  By  participating  in  DIA  operational  tasks, 
the  OIG,  DIA,  has  not  consistently  maintained  its  independence.  In  1996,  the 
Inspector  General  objected  to  a  request  from  DIA  management  for  personnel 
resources  to  be  deployed  to  Bosnia.  At  the  request  of  the  Director  in  February 
1997,  the  Inspector  General,  DoD,  provided  guidance  and  instruction  as  to  the 
prohibitions  of  using  the  OIG,  DIA,  staff  to  perform  operational  assignments 
within  DIA.  The  OIG,  DoD,  memorandum  dated  July  3,  1997,  indicated  that  the 
DoD  Directive  7600.2,  “Audit  Policies,”  February  2,  1991,  is  equally  applicable 
to  the  other  activities  of  the  OIG  and,  therefore,  the  OIG  staff  should  not  be  used 
on  operating  tasks.  The  OIG,  DoD,  recommended  that,  in  order  to  maintain  the 
independence  of  die  OIG,  the  IG  must  have  the  authority  to  decide  whether  to 
accept  or  reject  any  request  for  OIG  support.  In  addition,  the  OIG,  DoD, 
recommended  that  a  procedure  be  developed  that  allows  management  to  appeal 
any  rejection  to  the  Director  for  resolution.  Those  recommend^ations  were  never 
formally  addressed. 

In  March  1996,  the  Director  incorporated  the  OIG,  DIA,  in  the  approval  process 
for  acquisitions  to  provide  its  review  for  comment  until  “certain  controlling 
actions  and  oversight  arrangements  can  be  put  into  effect.  ”  More  than  2  years 
later,  in  November  1998,  the  DIGAI  reminded  the  DIA  procurement  division  that 
the  revision  of  the  acquisition  manual  should  include  the  OIG  for  “formal 
coordination  of  a  purchase  request,  per  direction  of  the  Director.”  The  OIG, 

DIA,  involvement  in  the  approval  process  of  the  purchase  requests  should  have 
been  only  temporary  until  the  DIA  procurement  division  developed  management 
controls  as  required  originally  by  the  Director.  The  March  1999  draft  of  the 
acquisition  manual  continues  to  show  the  OIG  as  providing  “Independent  Review 
and  Comments,  as  necessary.”  The  OIG,  DIA,  must  not  participate  in  the 
procurement  procedure  in  order  to  preserve  the  integrity  of  any  future  oversight 
or  investigation  of  the  procurement  process  in  whole  or  in  part.  Perception  or 
actual  participation  in  the  operation  prevents  the  OIG  from  objectively  or 
impartially  auditing,  inspecting,  or  investigating  the  procurement  process. 

In  the  summer  of  1998,  the  DIGAI  suggested  to  the  DIA  operating  components 
that  they  accept  OIG  staff  for  short-term  assignments  to  obtain  a  better  overall 
understanding  of  the  DIA  community.  Although  DoD  audit  policies  do  not 
prohibit  such  assignments,  special  care  must  be  exercised  to  avoid  compromising 
the  OIG  staffs  ability  to  independently  review  areas  in  which  OIG  staff  have  been 
or  are  currently  assigned  for  rotations. 

Due  Professional  Care.  The  audit  organization  is  responsible  for  ensuring  that 
every  audit  is  conducted  aceording  to  GAGAS.  Based  on  the  results  of  our 
quality  control  review,  the  deficiencies  identified  indicate  that  due  professional 
care  was  not  always  used.  For  example,  in  one  of  the  five  audits  reviewed,  a 
potential  illegal  act  by  a  contractor  was  included  in  the  audit  report  and  was  not 
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reported  to  the  AIG  for  Investigations.  Therefore,  the  auditors  need  awareness 
training  that  presents  the  importance  of  due  professional  care  and  illustrates 
practical  application  of  the  standards  in  conducting  audits. 

Quality  Control.  The  OIG,  DIA,  for  the  most  part,  has  formal  procedures  for  an 
appropriate  internal  quality  control  (QC)  system  as  required  by  GAGAS,  One- 
half  of  the  OIG,  DIA,  audit  manual  is  dedicated  to  quality  control  procedures  that 
include  an  independent  referencer  review,  checklist  for  review  of  individual 
audits,  technical  review,  IG  management  review,  and  an  audit  process 
effectiveness  survey  (requires  customer  input).  Nonetheless,  the  various  QC  steps 
were  not  always  completed  properly.  In  one  audit,  we  found  that  the  audit  guide 
was  not  prepared  for  the  audit  project  (as  acknowledged  by  the  individual 
referencer);  however,  the  section  on  "Audit  Planning"  was  answered  in  the 
affirmative  to  indicate  that  an  audit  guide  had  been  prepared.  In  another  example, 
the  audit  project  shows  documentation  for,  and  formally  reports  on,  an  illegal 
activity;  however,  the  related  checklist  items  were  marked  "not  applicable. " 
Another  audit  project  did  not  contain  a  completed  checklist  for  review  of  the 
individual  audit.  We  also  found  instances  where  the  QC  checklist  did  not  include 
signatures  and  dates  to  show  the  responsibility  for  timely  completion.  We  also 
found  that  the  required  checklist,  designed  for  performance  audits,  was  completed 
for  the  one  financial  audit  reviewed,  instead  of  a  more  extensive  checklist 
recommended  by  the  President’s  Council  on  Integrity  and  Efficiency. 

As  discussed  in  the  paragraph  above,  in  some  performance  audits,  the  QC 
checklist  items  are  assessed  positive  when  there  is  no  evidence  to  show  that  the 
item  was  accomplished  in  the  course  of  the  audit.  GAGAS  6.5. d.  states  "In 
planning  a  performance  audit,  auditors  should  consider  management  controls. "  In 
each  audit,  the  answer  to  the  question  regarding  whether  management  controls 
were  considered  during  the  planning  process  was  positive.  However,  as  discussed 
in  Field  Work  Standards  below,  the  OIG,  DIA,  has  no  procedures  in  the  planning 
phase  of  the  audit  to  assess  the  management  controls  of  the  audit  area.  The  QC 
forms  did  not  always  contain  the  documentation  in  the  working  papers  to 
determine  the  quality  of  the  audits.  The  auditors  need  recurrent  training  on  the 
use  of  GAGAS  and  its  application  to  their  adequately  designed  QC  system. 


Field  Work  Standards 

The  field  work  standards  that  are  identified  for  performance  and  for  financial 
audits  cover  the  following  areas:  audit  planning;  supervision;  evidence  and 
working  papers;  internal  controls;  and  identification  of  illegal  acts, 
noncompliance,  and  abuse. 

Audit  Planning.  Of  the  four  performance  audits  reviewed,  one  did  not  have  an 
audit  plan.  GAGAS  6.19  through  6.21  requires  a  written  audit  plan  be  prepared 
for  each  audit.  The  plan  should  include  an  audit  program,  a  memorandum,  or 
other  appropriate  documentation  of  key  decisions  about  the  audit  objectives, 
scope,  and  methodology  and  of  the  auditors’  basis  for  those  decisions.  It  should 
be  updated,  as  necessary,  to  reflect  any  significant  changes  to  the  plan  made 
during  the  audit. 
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The  typical  introduction  to  the  OIG,  DIA,  audit  program  refers  to  “suggested 
audit  steps”  as  does  the  audit  manual.  In  some  instances,  audit  program  steps  that 
were  not  performed  or  changed  had  no  documentation  to  justify  the  elimination, 
addition,  or  alteration  to  the  audit  plan.  The  audit  manual  and  each  audit  program 
should  include  guidance  or  instruction  as  to  the  importance  of  documenting  any 
change  to  the  audit  program. 

The  scope  of  three  of  four  performance  audits  appeared  too  ambitious  for  the 
stated  objectives  and  the  available  audit  resources  to  accomplish  the  audit  in  a 
reasonable  length  of  time.  As  a  result,  the  designed  audit  field  work  may  become 
outdated  and  ineffective  before  the  report  is  completed  and  the  audit  results  may 
not  be  reported  in  a  timely  manner  to  be  effectively  used  by  the  recipient.  One  of 
the  four  performance  audits  reviewed  eliminated  programmed  audit  steps  without 
justification  and  explanation  to  show  how  the  objectives  were  to  be  achieved.  The 
auditors  need  awareness  training  on  the  content  required  for  an  audit  program  and 
why  it  is  a  key  document  to  guide  the  entire  audit. 

Supervision.  We  found  that  the  performance  audit  working  papers  did  not  always 
show  evidence  of  supervisory  guidance  and  review,  despite  the  complex  and 
lengthy  nature  of  each  audit.  In  the  majority  of  the  five  audits  reviewed,  the 
quality  control  forms  related  to  supervision  were  completed.  The  GAGAS  6.22 
through  6.25  address  proper  supervision  as  directing  auditors  to  ensure  that  audit 
objectives  are  met  by  instructing,  keeping  informed  of  significant  problems, 
reviewing  the  audit  work,  providing  on-the-job  training,  and  satisfying  themselves 
that  the  auditors  understand  the  work  throughout  the  course  of  the  audit.  The 
OIG,  DIA,  Audit  Manual  is  also  specific  as  to  the  “prompt  supervisory  reviews” 
of  working  papers  that  are  required.  Evidence  of  supervision  normally  appears 
with  the  approval  of  the  audit  program,  if  available,  and  the  QC  assessments 
accomplished  near  the  end  of  the  audit.  Therefore,  the  overall  supervision  of 
audits  needs  to  be  improved. 

Evidence  and  Working  Papers.  The  one  financial  audit  reviewed  adequately 
meets  the  standards  for  evidence  and  working  papers  that  form  the  basis  for  the 
auditor’s  conclusions.  The  working  papers  for  the  four  performance  audits 
reviewed  had  deficiencies  in  documenting  the  purpose,  source,  scope,  and 
conclusion,  and  in  obtaining  sufficient  evidence  to  support  the  conclusions  reached 
in  the  working  papers  and  audit  reports.  The  prior  IG,  DoD,  report  also 
recommended  that  the  OIG,  DIA,  emphasize  the  need  for  better  compliance  with 
preparation  requirements  for  working  papers.  The  GAGAS  6.46  through  6.65 
indicate  that  evidence  is  to  be  sufficient,  competent,  and  relevant,  and  working 
papers  are  to  document  the  work  performed  and  support  the  significant 
conclusions  and  judgements.  The  OIG,  DIA,  audit  manual  also  contains  general 
standards  for  the  content  of  working  papers  to  include,  among  other  items, 
“sufficient  information  so  that  supplementary,  oral  explanations  are  not  required.” 
The  working  papers  were  generally  incomplete  in  describing  the  sources  for  data, 
methodologies  used,  and  conclusions.  During  the  course  of  one  audit,  a  technical 
term  for  a  contracting  document  was  changed  from  a  price  proposal  to  an 
equitable  adjustment  claim  without  any  evidence.  The  change  was  incorrect  and 
critical  to  the  audit  and  its  concluding  recommendations.  One  audit  could  not  be 
understood  without  considerable  vertel  explanation  as  to  the  start  and  finish  of  27 
binders  of  data  and  how  the  data  supported  the  audit  report. 


13 


All  of  the  working  papers  reviewed  did  not  have  complete  documentation  of 
administrative  matters  including  correspondence  inside  and  outside  the  OIG,  DIA, 
exit  conferences,  draft  report  proceedings,  and  post  audit  documentation.  All  of 
those  transactions  are  important  to  show  the  audit  progress.  For  the  OIG,  DIA, 
the  documentation  of  a  project’s  status  is  crucial  to  its  mission.  Aside  from  the 
audit  function  but  still  requiring  proper  evidence  according  to  the  inspection 
manual,  an  inspection  project  was  cancelled  after  a  working  draft  of  the  inspection 
findings  had  been  prepared.  The  OIG,  DIA,  and  we  could  not  find  documentation 
in  the  working  papers  to  explain  the  cancellation  of  the  project.  In  addition, 
extensive  survey  data  supporting  the  unissued  draft  inspection  report  was 
destroyed  by  the  lead  inspector  based  on  a  personal  decision  that  it  was  no  longer 
needed.  The  DIA  Manual  13-1,  200  series  shows  that  the  OIG  records  generated 
in  support  of  inspections  (Section  240),  investigations  (Section  245)  and  audits 
(Section  251)  are  to  be  maintained  in  current  files  for  3  years  and  then  transferred 
to  a  record  center.  The  OIG,  DIA,  needs  periodic  awareness  training  on  the 
GAGAS  requirements  for  working  papers,  the  importance  of  collecting  acceptable 
evidence  to  support  the  conclusions  and  record  retention  requirements. 

Internal  Controls.  None  of  the  four  performance  audits  selected  for  review  had 
documented  evidence  of  the  management  controls  and  the  self-assessment  by  the 
audit  subject.  The  audit  manual  does  not  contain  written  policies  or  procedures 
for  determining  the  status  of  management  control  programs  of  the  targeted  DIA 
components.  The  DIA  Regulation  41-1  identifies  the  OIG,  DIA,  responsibility  for 
evaluating  management  controls  in  its  reviews.  The  management  of  the  targeted 
DIA  component  is  responsible  for  its  management  controls.  At  the  onset  of  a 
project,  the  OIG,  DIA,  should  review  the  DIA  component’s  MCP  for 
management  control  assessments,  identified  weaknesses,  and  corrective  action 
plans.  In  addition,  the  OIG,  DIA,  should  review  the  relevant  statements  of 
assurance  from  the  assessable  units  that  comprise  the  DIA  component  to  be 
reviewed. 

The  GAGAS  6.39  for  field  work  refers  to  obtaining  “an  understanding  of 
management  controls  that  are  relevant  to  the  audit.”  As  part  of  the  procedure  to 
obtain  an  understanding  of  the  management  controls,  GAGAS  has  the  following 
prominent  standards  that  address  the  source  of  information  provided  by  the  DoD 
requirement  for  a  management  control  program: 

6.44  Internal  auditing  is  an  important  part  of  management  control. 

When  an  assessment  of  management  controls  is  called  for,  tlie  work  of 
the  internal  auditors  can  be  used  to  help  provide  reasonable  as.surance 
that  management  controls  are  functioning  properly  and  to  prevent 
duplication  of  effort. 

6.45  Considering  the  wide  variety  of  government  programs,  no  single 
pattern  for  internal  audit  activities  can  be  specified.  Many  government 
entities  have  these  activities  identified  by  otlier  names,  such  as 
inspection,  appraisal,  investigation,  organization  and  methods,  or 
management  analysis.  These  activities  assist  management  by  reviewing 
selected  functions. 

The  start  of  an  audit,  inspection,  or  investigation  is  handieapped  if  the 
component’s  MCP  is  not  reviewed.  An  understanding  of  the  environment  is 
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essentially  obtained  from  assessing  the  DoD-required  management  control 
programs  and  establishing  the  risk  associated  with  the  audit,  inspection,  or 
investigation. 

Identification  of  Illegal  Acts,  Noncompliance,  and  Abuse.  The  auditor’s  role  in 
detecting  fraud  has  been  misconstrued  in  the  OIG,  DIA,  procedures  and  formal 
reporting.  The  OIG,  DIA,  audit  manual  includes  a  section  titled  “Fraud 
Detection”  that  states: 

For  each  performance  and  financial  audit,  DIA  management  shall  be  informed 
that  part  of  our  responsibility  is  to  detect  fraud,  and  that  several  questions  will  be 
asked  concerning  the  potential  or  actual  occurrence  of  fraud  in  the  program  or 
system  being  audited.  During  each  audit,  cognizant  program  officials  will  be 
directly  asked  whether  fraud  has  been  a  problem  for  the  organization,  program 
or  system,  and  the  ways  in  which  fraud  could  be  conmiitted  if  someone  desired 
to  do  so. 

The  underlying  tone  of  the  above  procedure  is  contrary  to  the  GAGAS  6.28  that 
requires  “Based  on  [illegal  acts]  risk  assessment,  the  auditors  design  and  perform 
procedures  to  provide  reasonable  assurance  of  detecting  significant  illegal  acts.” 
The  audit  manual  should  show  that  the  audit  checks  for  compliance  with 
applicable  laws,  regulations,  and  other  compliance  requirements,  not  for  the 
presence  of  fraud. 

One  audit  found  “integrity  issues”  and  reported  them  in  the  audit  report,  which 
recommends  that  DIA  management  advise  the  wrongdoers  of  the  potential  impact 
and  criminal  nature  of  their  actions.  The  OIG,  DIA,  audit  manual  requires  that 
“all  cases  of  actual  or  suspected  fraud  detected  during  audits  shall  be  brought  to 
the  attention  of  the  AIG  for  Audits,  who  shall  refer  them  to  the  AIG  for 
Investigations  for  further  review.”  There  was  no  documentation  in  the 
workpapers  that  this  matter  was  referred  to  the  AIG  for  Investigations.  The  lack 
of  referral  was  corroborated  during  the  interview  of  an  investigator  who 
discovered  the  9-month-old  subject  audit  report  after  initiating  an  investigation 
involving  the  same  contractor,  but  for  other  reasons.  The  GAGAS  6.33  requires 
auditors  to  “exercise  due  professional  care  in  pursuing  indications  of  possible 
illegal  acts  so  as  not  to  interfere  with  potential  investigations,  legal  proceedings, 
or  both.”  An  audit  report  is  not  the  vehicle  for  reporting  or  resolving  illegal 
activity  and  can  be  detrimental  to  resolving  the  matter  by  proper  authorities. 

The  majority  of  the  performance  audits  reviewed  did  not  have  the  proper  risk 
assessments  and  procedures  to  detect  significant  illegal  activity  that  could  occur. 
The  auditors  need  awareness  training  on  exercising  due  professional  care  in 
detecting  fraud  and  following  proper  procedures  when  potential  illegal  acts  are 
indicated.  The  procedures  contained  in  the  OIG,  DIA,  audit  manual  need  to  be 
revised  to  reflect  the  GAGAS. 


Reporting  Standards 

The  reporting  standards  are  specific  to  performance  audits  and  to  financial  audits. 
The  financial  audit  meets  the  respective  reporting  standards;  however, 
improvements  are  needed  for  the  performance  audits.  The  prior  IG,  DoD,  report 
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contained  a  recommendation  for  the  OIG,  DIA,  to  “emphasize  the  need  to 
adequately  present  in  a  clear  manner  all  required  elements  in  audit  reports,” 

The  emphasis  was  provided  to  the  auditors  in  a  single  memorandum  dated 
August  9,  1994. 

The  performance  audit  reports  we  reviewed  could  be  improved  by  including  a 
more  complete  scope  and  findings  description,  an  appropriate  qualifier  when 
GAGAS  is  not  followed,  proper  reporting  of  instances  of  illegal  acts, 
noncompliance  and  abuse,  a  scope  description  of  work  on  management  controls 
and  any  related  findings,  and  a  more  timely  issuance  of  reports.  The  audit  staff 
needs  awareness  training  expanded  to  include  audit  report  preparation. 

Conclusion 


In  our  opinion,  the  system  of  quality  control  for  the  audit  function  of  the  OIG, 
DIA,  in  effect  for  the  fiscal  years  1996  through  1998,  has  been  adequately 
designed  with  the  quality  standards  as  promoted  by  the  President’s  Council  on 
Integrity  and  Efficiency.  However,  based  on  the  deficiencies  discussed  above,  the 
system  of  quality  control  needs  to  be  improved  to  provide  the  OIG,  DIA,  with 
greater  assurance  of  conforming  to  the  Government  Auditing  Standards  issued  by 
the  Comptroller  General  of  the  United  States. 

Recommendations,  Management  Comments,  and  Evaluation 
Response 


C.l.  We  recommend  that  the  Director,  Defense  Intelligence  Agency: 
a.  Revise  regulations  to  provide— 

(1)  A  separate  line  item  for  the  Office  of  Inspector  General, 
Defense  Intelligence  Agency,  operating  budget  (to  include  training)  in  the 
Defense  Intelligence  Agency  budget. 

DIA  Comments.  The  DIA  concurred  in  part  by  indicating  that  a  separate  budget 
record  is  maintained  for  the  OIG,  DIA. 

Evaluation  Response.  We  consider  the  DIA  comments  to  be  responsive  to  the 
intent  of  the  recommendation.  In  allocating  resources  to  an  OIG,  it  is  important 
that  management  fully  consider  the  sometimes  unique  requirements  of  the  OIG 
and  avoid  perceptions  that  other  agency  staff  components  control  portions  of  the 
OIG  budget,  enabling  them  to  limit  OIG  authority.  Designating  the  OIG,  DIA,  a 
separate  line  item  in  the  operating  budget  will  assist  in  ensuring  its  independence. 

(2)  Sole  authority  to  the  Inspector  General,  Defense 
Intelligence  Agency,  within  applicable  laws  and  regulations,  to  manage  the 
funds  appropriated  for  the  Office  of  Inspector  General. 

DIA  Comments.  The  DIA  concurred. 
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b.  Establish  procedures  as  outlined  in  the  Inspector  General,  DoD, 
memorandum,  July  3,  1997,  that  the— 

(1)  Inspector  General,  Defense  Intelligence  Agency,  be  given 
the  authority  to  accept  or  reject  management’s  request  for  Office  of  Inspector 
General  resource  support  to  operational  activities. 

(2)  Defense  Intelligence  Agency  management  be  ^ven  the 
authority  to  elevate  any  rejection  for  support  to  operational  activities  by  the 
Inspector  General,  Defense  Intelligence  Agency,  to  the  Director,  Defense 
Intelligence  Agency,  for  resolution. 

DIA  Comments.  The  DIA  concurred. 

c.  Terminate  the  participation  of  the  Office  of  Inspector  General, 
Defense  Intelligence  Agency,  in  the  approval  procedure  for  acquisitions  and 
require  that  the  Office  of  Inspector  General  periodically  audit  the 
procurement  procedures  and  the  related  management  controls. 

DIA  Comments.  The  DIA  concurred. 

C.2.  We  recommend  that  the  Inspector  General,  Defense  Intelligence 
Agency; 


a.  Prepare  and  use  the  Individual  Development  Plans  to  develop 
the  annual  training  budget  and  to  manage  the  requirement  for  continuing 
professional  education  according  to  the  generally  accepted  government 
auditing  standards. 

DIA  Comments.  The  DIA  concurred. 

b.  Arrange  regularly  scheduled  awareness  training  for  the  andit 
staff  on  the  requirements  for  audit  responsibility,  due  professional  care,  audit 
planning,  supervision,  working  paper  preparation,  collection  of  evidence, 
responsibility  in  detecting  fraud,  referring  suspected  illegal  acts  to  the  proper 
authorities,  reporting  on  illegal  acts,  and  reports  on  performance  audits 
according  to  the  generally  accepted  government  auditing  standards. 

DIA  Comments.  The  DIA  concurred  with  the  intent  of  the  recommendation  and 
recognized  the  objectives  to  be  achieved  by  implementing  the  recommendation. 
They  indicated  that  the  IDPs  have  always  served  to  manage  the  continuing 
professional  education  for  the  audit  staff  but  the  IDPs  cannot  be  used  for  budget 
execution  due  to  the  incompatible  timing  of  the  two  processes. 

Evaluation  Response.  As  recommended  in  our  1994  report,  the  preparation  and 
use  of  the  IDPs  need  to  be  formalized  and  appropriately  scheduled  in  the  OIG, 
DIA,  procedures  to  consistently  manage  the  continuing  professional  education 
needs.  Despite  the  timing  difference  in  the  preparation  of  the  budget  information 
and  the  IDPs,  the  future  requirements  for  the  training  budget  as  well  as  the 
allocation  of  current  year  appropriations  can  be  justified  from  the  more  current 
IDPs  and  more  realistically  estimated  from  well-managed  IDPs. 
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c.  Amend  the  Internal  Audit  Manual,  January  10, 1997,  to  show: 

(1)  The  audit  program  is  a  key  document  to  show  the  course  of 
an  audit  and  any  additions,  deletions,  or  changes  are  to  be  accompanied  by 
an  explanation  and  approved  by  the  audit  supervisor. 

DIA  Comments.  The  DIA  concurred. 

(2)  The  auditor’s  responsibility  in  detecting  fraud  is  to: 

(a)  Provide,  through  the  design  of  the  audit  steps, 
reasonable  assurance  about  the  auditee’s  compliance  with  applicable  laws, 
regulations,  and  other  requirements. 

(b)  Properly  document  any  indications  of  illegal  acts  and 
report  them  to  the  proper  authorities,  not  the  wrongdoer. 

(c)  Coordinate  any  audit  reports  with  indications  of 
potential  illegal  acts  or  related  to  an  area  under  investigation  or  litigation 
with  the  cognizant  investigative  or  prosecutive  organization  before  issuing  the 
report. 

DIA  Comments.  The  DIA  concurred. 

d.  Provide  refresher  training  for  the  Office  of  the  Inspector 
General’s  staff  on  the  requirements  for  all  working  paper  content,  the 
responsibility  and  determination  for  destruction  of  records,  and  the  retention 
of  the  working  paper  records. 

DIA  Comments.  The  DIA  concurred. 

e.  Maintain  a  permanent  file  of  the  management  control  programs 
and  annual  statements  of  assurance  for  the  assessable  units  within  Defense 
Intelligence  Agency  and  use  the  information  in  preparing  the  Office  of  the 
Inspector  General  annual  program  plan  and  individual  project  plans. 

DIA  Comments.  The  DIA  concurred. 
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D.  Management  and  Effectiveness  of  the 
Investigative  Mission 

The  investigative  program  lacked  goals,  objectives,  measurements,  and 
proactive  efforts  that  should  have  focused  on  significant  DIA  mission  areas 
or  programs.  Investigators  were  converted  to  the  1811,  Criminal 
Investigating  series,  without  the  benefit  of  a  needs  analysis.  Then,  since 
most  actual  investigative  requirements  were  administrative  in  nature,  a 
fully  functional  criminal  investigative  program  was  never  subsequently 
implemented.  The  OIG,  DIA,  lacked  sufficient  investigative  policy  and 
failed  to  properly  implement  DoD  investigative  policies  and  procedures. 

A  disparity  existed  between  the  articulated  investigative  program  (criminal 
investigations)  and  actual  practice  (administrative  investigations).  During 
the  period  evaluated,  more  than  99  percent  of  OIG  investigations  focused 
on  administrative  outcomes;  traditional  criminal  investigative  techniques 
were  not  used.  However,  OIG  investigations  were  highly  valued  by  DIA 
leadership  and  were  thorough  when  viewed  as  administrative 
investigations. 

Management  of  the  Investigative  Program 


Investigative  Goals,  Objectives,  and  Performance  Measures.  The  only 
evidence  of  articulated  goals  and  objectives  in  the  OIG,  DIA,  investigative 
program  was  found  in  the  OIG  annual  plan.  The  annual  plans  for  FY  1996 
through  1998  state  that  the  IG  will,  “conduct  investigations,  ensure  its 
investigative  staff  is  trained  and  maintains  a  professional  attitude,  manage  the 
hotline,  and  coordinate  with  other  agencies,”  in  addition  to  pursuing  a  “preventive 
approach.”  The  objectives  were  not  further  defined,  milestones  in  meeting  the 
objectives  were  not  established,  and  performance  measurements  were  not 
developed.  There  was  no  evidence  that  the  IG  or  the  DIG  for  Investigations 
sought  DIA  leadership  input  in  developing  an  investigative  program  that  addressed 
significant  agency  programs  or  areas  of  vulnerability.  The  OIG,  DIA,  has  no 
articulated  plan  to  identify  vulnerable  DIA  mission  areas  or  programs  and  to  focus 
investigative  resources  accordingly.  Proactive  measures  such  as  fraud  briefings, 
liaison,  use  of  sources,  and  target  analyses  typically  found  in  criminal 
investigative  and  intelligence  organizations  were  not  employed.  Workload  in  the 
Office  of  the  DIG  for  Investigations  was  largely  determined  by  employee 
complaints,  or  by  an  occasional  referral  from  another  DIA  element  or  the 
Director.  Additionally,  the  AIG  for  Investigations  had  no  articulated  procedure  to 
regularly  measure  and  track  case  timeliness,  or  to  establish  caseload  priority. 

OIG,  DIA,  SOP  01-91,  "Accountability  for  OIG  Business,"  March  27,  1991, 
states, 


.  .  .  field  investigation  will  be  recommended  when  there  is  clear 
indication  in  the  complaint  that  people,  funds,  programs,  operations  or 
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material  belonging  to  the  DIA  are,  have  been,  or  will  be  involved  in 
criminal,  misconduct,  wasteful,  or  mismanagement  activity  that  could 
result  in  criminal  prosecution,  administrative  action,  or  civil  action. 

The  SOP  later  describes  issues  that  are  more  appropriate  for  management  (versus 
investigative)  followup,  including:  minor  misconduct  not  threatening  the  integrity 
of  DIA  operations;  drinking  on  duty;  gambling  or  soliciting;  absent  without  leave; 
personal  use  of  Government  telephone;  insubordination;  complaints  of 
discrimination  or  sexual  harassment;  and  personnel,  physical,  or  computer 
security  program  matters.  Further,  the  organization’s  priorities  for  matters 
accepted  for  investigation  are  articulated  in  SOP  93-03,  "Procedures  for 
Investigative  Case  Files  and  Case  Management,"  March  8,  1993.  The  SOP  states 
that  lowest  priority  will  be  assigned  to  cases  involving  “regulatory  or 
administrative  violations  with  minimal  loss  or  damage  to  the  government,” 
including  false  travel  claims,  time  and  attendance  fraud,  and  the  misuse  of 
Government  property  or  equipment. 

The  actual  caseload  of  the  office  demonstrates  lack  of  compliance  with  the  stated 
guidelines  for  case  acceptance  and  prioritization.  Analysis  of  the  types  of  cases 
investigated  over  the  FYs  1996  through  1998  reflects  that  in  each  of  the  3  years, 
zero  files,'  mismanagement,  and  personnel  assistance^  constitute  nearly  one-half 
of  OIG,  DIA,  investigative  caseload.  There  was  no  program  to  assess  compliance 
with  case  acceptance  or  prioritization  guidelines  or  to  track  progress  of  cases. 

Use  of  1811,  Criminal  Investigating  Series  and  “Criminal”  Investigator 
Issues.  In  1992,  the  IG,  DIA,  hired  a  senior  1811,  Criminal  Investigating  series 
employee  (hereafter  referred  to  as  "1811  series")  from  the  Department  of 
Commerce  to  serve  as  Deputy  Inspector  General  for  Investigations  (DIGI)  in  an 
organization  the  IG  was  reforming  to  mirror  that  of  a  statutory  inspector  general. 
Investigative  positions  were  filled  by  DIA  employees  who  had  formerly  served  in 
other  job  series  and  were  converted  to  the  1801,  General  Investigating  series, 
upon  assignment  under  the  DIGI.  Later,  these  employees  were  incrementally 
converted  to  the  1811  series  as  they  completed  the  basic  criminal  investigator 
course  at  the  Federal  Law  Enforcement  Training  Center.  Through  the  DIA 
Human  Resources  office,  the  OIG  effected  the  investigators’  payments  of  LEAP,^ 
a  25  percent  addition  to  the  criminal  investigator  basic  pay  intended  to  compensate 
criminal  investigators  for  the  frequently  erratic  hours  and  distinctive  overtime 
requirements  inherent  in  law  enforcement  duties.  An  extra  half  percent  was  also 
withheld  from  their  pay  for  law  enforcement  retirement,''  a  program  that  allows 


'Describes  an  allegation  that  is  merely  recorded  in  tlie  OIG,  DIA,  database  for  future  reference, 
but  for  which  no  substantial  investigative  effort  is  expended. 

^Matters  pursued  by  OIG,  DIA,  investigators  wherein  it  is  believed  tliat  an  individual  has 
exhausted  other  available  means  of  resolving  a  matter. 

’Law  Enforcement  Availability  Pay;  paid  to  criminal  investigators  equal  to  25  percent  of  their  rate 
of  basic  pay  (as  defined  in  5  CFR  550.103),  with  the  assumption  tlie  criminal  investigator  will  be 
available  for  rmscheduled  duty  an  average  of  2  hours  of  overtime  per  day  when  averaged  over  the 
entire  year.  (5  U.S.C.  5545a). 

■'Enables  law  enforcement  officers  at  age  50  years  to  retire  with  20  years  of  service  or  at  any  age 
with  25  years  of  service.  15  U.S.C.  8336(c)  for  employees  covered  under  the  Civil  Service 
Retirement  System  (CSRS)  or  5  U.S.C.  8412(d)  for  employees  covered  under  the  Federal 
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law  enforcement  officers  to  retire  after  20  years  of  service.  However,  the 
converted  investigators  could  not,  by  definition,  participate  in  a  law  enforcement 
retirement  program  since  they  were  above  the  maximum  age  upon  conversion  to 
the  1811  series.^ 

In  addition  to  this  evaluation,  a  separate  investigation  was  conducted  by  the  OIG, 
DoD,  into  the  possibility  that  the  withdrawal  of  LEAP  constituted  a  reprisal. 

Both  determined  that  the  positions  the  OIG,  DIA,  investigators  occupied  were 
never  actually  “covered”  (approved  by  the  Office  of  Personnel  Management 
[0PM],  as  delegated  to  the  DoD)  for  law  enforcement  retirement  purposes. 
Therefore,  the  investigators  were  never  actually  entitled  to  either  law  enforcement 
retirement  coverage  or  LEAP.  The  connection  between  “covered”  positions  and 
LEAP  is  not  readily  apparent  in  examining  the  statutory  and  regulatory  guidance 
but  was  clarified  after  consulting  0PM  functional  experts  and  reviewing 
explanatory  comments  in  the  Federal  Register  when  LEAP  was  introduced. 

Leadership  within  the  DIA  as  well  as  within  the  Office  of  the  Assistant  Secretary 
of  Defense  (Command,  Control,  Communications,  and  Intelligence)  has 
questioned  whether  the  OIG,  DIA,  should  employ  criminal  investigators.  The 
OIG,  DIA,  investigators  have  defended  their  placement  in  the  1811  series, 
maintaining  that  most  of  the  acts  they  investigate  are  violations  of  Federal  law. 
Further  evidence  of  the  disconnect  that  exists  between  the  articulated  identity  of 
the  OIG  criminal  investigators  (1811  series)  and  their  actual  practice  appears  in 
OIG,  DIA,  SOP  92-04,  “DoD  Titling  and  Indexing  of  Subjects  of  Criminal 
Investigations  in  the  DIA,”  November  4,  1992,  which  states,  “Due  to  IG  limited 
computer  capabilities,  monetary  constraints  on  expanding  computer  capabilities, 
and  the  very  limited  number  of  criminal  investigative  issues  pursued  at  any  given 
time  [emphasis  added],  the  IG  will  submit  a  written  monthly  listing  of  all  subjects 
of  criminal  investigations  .  .  .  .  ” 

A  prior  review  by  the  Defense  Civilian  Personnel  Management  Service 
concluded,  based  on  interviews  and  a  review  of  personnel  records  and  policy 
documents,  that  the  OIG,  DIA,  investigators  were  properly  classified  in  the  1811 
series.  Our  review,  however,  included  an  in-depth  examination  of  DIA 
investigative  casework.  We  found  that  most  OIG,  DIA,  investigations  are  more 
appropriately  described  as  administrative  in  nature.  Although  the  alleged  acts 
investigated  may  have  been  violations  of  criminal  law,  the  investigations 
themselves  were  not  conducted  as  “criminal  investigations”  because  they  were  not 
conducted  using  case-appropriate  criminal  investigative  steps  and  techniques.  The 
investigations  also  did  not  emphasize  the  collection  of  evidence  for  the  purpose  of 
presenting  a  case  to  a  prosecutor.  On  the  contrary,  most  investigations  were 
designed  from  the  outset  to  be  resolved  administratively. 


Employees  Retirement  System  (FERS)]. 

^Maximum  entry  age  of  35  is  recognized  in  DoD  Directive  1402.4,  “Entry  Age  for  Selected 
Firefighter  and  Law  Enforcement  Officer  Positions,”  December  29,  1988. 
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The  following  information  is  relevant  in  determining  whether  the  OIG,  DIA, 
investigative  staff  must  be  made  up  entirely  of  criminal  investigators. 

•  Of  the  583  cases  logged  in  FYs  1996  through  1998,  only  six  have  been 
presented  to  a  prosecutor;  two  were  declined  by  a  military  Staff  Judge 
Advocate;  one  was  declined  by  the  Public  Integrity  Section, 

Department  of  Justice;  three  remaining  were  conducted  with  another 
criminal  investigative  agency  serving  in  the  lead  role  and  are  pending 
additional  investigation  in  coordination  with  an  Assistant  United  States 
Attorney.® 

•  Of  the  583  cases  logged  in  FYs  1996  through  1998,  580  cases 
(99  percent)  were  resolved  administratively. 

•  In  most  cases,  the  OIG,  DIA,  investigators  employed  administrative 
investigative  techniques  in  the  investigation  of  matters  that  were 
resolved  administratively. 

•  The  OIG,  DIA,  does  not  have  policy  that  addresses,  nor  does  it  have 
investigators  engaged  in  activities  (except  on  rare  occasions  in  support 
of  a  law  enforcement  organization)  that  involve:  collection  and 
preservation  of  physical  evidence,  carrying  or  use  of  firearms,  use  of 
technical  investigative  equipment,  physical  fitness  requirements, 
24-hour  duty  investigator  requirement,  surveillance,  use  of  contingency 
funds,  undercover  work,  execution  of  search  warrants,  and  use  of 
human  sources  of  information  (informants). 

•  The  investigators  sometimes  performed  operational  rather  than 
investigative  functions.  Equal  Employment  Opportunity  (EEO) 
complaints  were  investigated  by  OIG  investigators  despite  the  existence 
of  the  DIA  Diversity  Management  office  whose  mission  includes  EEO 
matters.  The  IG  and  investigative  staff  related  that  such  cases  should 
not  be  investigated  by  the  IG  but  advised  that  the  decision  was  made  by 
the  Director  to  assign  several  such  cases  to  the  OIG.  The  EEO  cases 
consumed  considerable  investigative  staff-hours. 

•  The  OIG,  DIA,  investigators  do  not  have  arrest  authority,  nor  are  they 
authorized  to  apply  for  Federal  search  warrants.’ 

The  classification  standards  for  criminal  investigator  positions  provide  that  it  is 
the  employee’s  job  related  activities  (duties  and  responsibilities  of  the 
investigator),  not  merely  the  nature  of  the  complaints  being  investigated  that 
ultimately  must  be  compared  to  the  classification  standard.  In  other  words,  it  is 
both  the  nature  of  investigative  actions  and  duties  coupled  with  the  nature  of  the 
alleged  activity  on  which  an  investigation  is  based  that  makes  an  investigation  a 
“criminal”  investigation.  Further,  based  on  review  of  the  0PM  “Handbook  of 


‘‘97-4691  and  97-4518  were  presented  and  declined  by  a  Staff  Judge  Advocate;  96-4427  was 
evaluated  and  declined  by  die  Public  Integrity  Section,  Department  of  Justice;  96-4289,  98-4732, 
and  98-4805  pending  an  Assistant  United  States  Attorney  coordination. 

’See  28  CFR  Part  60. 
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Occupational  Groups  and  Families,”  it  is  apparent  that  the  duties  most  often 
performed  by  DIA  investigators— conducting  interviews,  the  collection  of  records, 
and  writing  reports  to  DIA  managers  for  action-most  closely  approximate  those 
described  in  the  1801  series  (see  Appendix  C). 

The  historical  lack  of  criminal  investigative  activities  by  DIA  investigators  does 
not  necessarily  preclude  the  need  for  resident  criminal  investigators.  DoD  policy 
requires  Defense  agencies  such  as  the  DIA  to  refer  criminal  fraud  matters  (most 
crimes  typically  encountered  by  an  OIG)  to  the  Defense  Criminal  Investigative 
Service  (DCIS).  Other  crimes  by  military  personnel  assigned  to  DIA  are  the 
purview  of  the  Military  Criminal  Investigative  Organizations  (MCIO).®  Non¬ 
fraud  crimes  committed  by  civilians  are,  generally,  the  purview  of  other  Federal, 
state,  or  local  law  enforcement  agencies.  The  DCIS  supports  DIA  by  assigning 
DIA  criminal  investigative  coverage  to  an  agent  in  the  DCIS  Mid-Atlantic  Field 
Office.  That  agent  works  jointly  with  OIG,  DIA,  investigators  and  typically  relies 
on  DIA  investigators  for  assistance.  Although  such  assistance  is  primarily 
administrative  in  nature  (identifying  key  persons  and  documents,  explaining  DIA 
programs  and  processes),  occasionally  DIA  investigators  are  asked  to  assist  in  law 
enforcement  tasks  such  as  surveillance,  searches,  and  key  witness  and  subject 
interviews.  Also,  because  the  servicing  DCIS  agent  does  not  physically  work  in 
the  DIA  environment  (composed  largely  of  classified  and  compartmented 
programs)  on  a  daily  basis,  his  ability  to  employ  proactive  criminal  investigative 
techniques  (use  of  informants,  and  other  criminal  intelligence  gathering 
techniques)  is  limited.  If  those  proactive  approaches  were  employed  regularly  by 
OIG,  DIA,  investigators,  use  of  at  least  one  organic  (or  on-scene)  1811  series 
investigator  would  be  appropriate.  An  1811  series  investigator  could  pursue 
proactive  criminal  investigative  measures  designed  to  identify  fraud  and  other 
criminal  behavior,  assist  criminal  investigative  agencies  in  cases  for  which  OIG, 
DIA,  has  primary  or  joint  responsibility,  and  conduct  criminal  cases  not  accepted 
by  the  DCIS  or  the  MCIOs.  Alternatively,  assuming  the  need  is  justified  and 
staffing  is  available,  the  DCIS  could  assign  an  agent  to  DIA  full  time,  to  develop 
criminal  intelligence,  to  assess  the  need  for  proactive  measures,  and  to  implement 
them.  Either  approach  should  be  based  on  a  coordinated  study  of  the  need  for 
resident  criminal  investigative  support. 

Compliance  With  DoD  Criminal  Investigative  Policy.  Although  the  IG,  DIA, 
desired  to  establish  a  criminal  investigative  program,  including  the  use  of  1811 
series  investigators,  DoD  directives  and  instructions  impacting  the  criminal 
investigative  community  were  either  not  incorporated  into  OIG,  DIA,  policy  and 
practice  or  were  incorporated  improperly,  as  discussed  below. 

•  DoD  Instruction  5240.4,  “Reporting  of  Counterintelligence  and 
Criminal  Violations,”  September  22,  1992,  requires  the  “expeditious 
reporting  ”  of  significant  matters  through  channels  to  the  Secretary  of 
Defense.  The  OIG,  DoD,  serves  as  the  “focal  point  for  receiving 
information  and  monitoring  significant  criminal  cases .  .  .  .”  [emphasis 
added].  The  OIG,  DIA,  however,  has  inteipreted  this  as  a  requirement 
to  refer  such  matters  to  the  OIG,  DoD,  which  in  several  cases  caused 


®U.S.  Army  Criminal  Investigation  Command  (USACIDC),  Naval  Criminal  Investigative  Service 
(NCIS),  and  the  Air  Force  Office  of  Special  Investigations  (AFOSI). 
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delays  in  investigations  while  the  OIG,  DIA,  unnecessarily  waited  for 
the  OIG,  DoD,  to  assume  responsibility.®  Conversely,  when 
interviewed,  the  investigators  erroneously  believed  that  matters  not 
meeting  the  DoDI  5240.4  threshold  need  not  be  referred  to  the  OIG, 
DoD,  when,  in  fact,  DoD  Instruction  5505.2  (discussed  below) 
requires  the  DIA  to  refer  all  fraud  matters  to  the  DCIS. 

•  DoD  Instruction  5505.2,  “Criminal  Investigations  of  Fraud  Offenses,” 
July  16,  1990,  requires  the  Director  as  an  Office  of  the  Secretary  of 
Defense  Component  Head,  to  (a)  “Establish  procedures  ...  to  ensure 
that  all  allegations  of  fraud  involving  persons  affiliated  with  the 
Department  of  Defense  and  any  property  or  programs  under  their 
control  or  authority  are  referred  promptly  to  the  DCIS”  [emphasis 
added],  and  (b)  “Establish  procedures  providing  for  the  investigation 
of  less  significant  fraud  allegations  when  the  DCIOs'®  neither 
investigate  the  matter  nor  refer  it  elsewhere  for  investigation. 

(Examples  of  alternative  investigative  resources  include  military  or 
security  police  elements,  other  designated  DoD  investigators,  or 
command  authorities.)”  In  most  instances,  only  matters  reaching  the 
reporting  threshold  of  two  DoD  documents  were  formally  referred  to 
the  OIG,  DoD,  because  the  OIG,  DIA,  was  operating  under  a 
misinterpretation  of  DoD  Instruction  5240.4  and  DoD  Directive  5505.6 
(discussed  below).  Investigators  of  the  OIG,  DIA,  have,  however, 
maintained  a  viable  working  relationship  with  the  DCIS  special  agent 
assigned  to  support  DIA.  Thus,  significant  criminal  cases  were 
brought  to  the  attention  of  DCIS  at  the  agent  level. 

•  DoD  Directive  5505.6,  “Investigations  of  Allegations  Against  Senior 
Officials  of  the  Department  of  Defense,”  July  12,  1991,  prescribes 


’DoDI  5240.4,  paragraph  4,  requires  significant  counterintelligence  activities,  criminal  cases,  and 
instances  of  espionage  to  be  reported  expeditiously  through  established  channels  to  the  Secretary 
of  Defense.”  Paragraph  5,  in  describing  the  DoD  mandated  procedure,  states:  “This  Instruction 
requires  timely  reporting  to  the  Inspector  General  of  the  Department  of  Defense  (IG,  DoD)  or  the 
Assistant  Secretary  of  Defense  tor  Command,  Control,  Coimnunications,  and  Intelligence 
(ASDCT)  and  the  General  Counsel  of  the  Department  of  Defense  (GC,  DoD),  of  every 
significant  criminal  case,  instance  of  espionage,  and  counterintelligence  activity  within  the 
Department  of  Defense  or  involving  a  DoD  contractor.”  Significant  incidents  are  defined  as  (1) 
counterintelligence  activities  that  are  significant  in  and  of  themselves  or  that  are  likely  to  receive 
publicity,  (2)  Criminal  cases  involving  (a)  allegations  of  fraud  or  theft  with  a  potential  loss  to  the 
government  of  $500,000  or  more,  or  when  the  subject  is  an  installation  or  ship  commander,  or  is 
in  or  retired  from  the  military  grade  of  0-6  and  above  or  civilian  grade  GS/GM  15  and  above, 
and  the  potential  loss  to  tlie  Government  is  $5,000  or  more,  or  (b)  criminal  corruption  cases 
related  to  procurement  involving  current  or  retired  DoD  military  or  civilian  personnel;  (c)  Any 
investigation  into  defective  products  or  product  substitution  in  which  a  SERIOUS  HAZARD  to 
health,  safety,  or  occupational  readiness  is  indicated;  (d)  Any  criminal  case,  which,  if  disclosed, 
could  reasonably  be  expected  to  receive  significant  media  coverage;  and  (3)  espionage. 

Paragraph  6,  Responsibilities,  requires  the  OIG,  DoD,  to  serve  as  a  focal  point  for  receiving 
information  and  monitoring  significant  criminal  cases.  The  Heads  of  the  DoD  Components  are 
directed  to  establish  internal  reporting  procedures. 

‘“MCIOs  plus  the  DCIS 
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procedures  for  reporting  to  the  OIG,  DoD,  allegations  of  serious 
misconduct  against  senior  officials  of  the  Department  of  Defense.  It 
states,  “allegations  of  serious  misconduct  against  senior  DoD  officials 
shall  be  promptly  reported  to  the  OIG,  DoD,  at  the  time  such 
allegations  are  received  by  another  DoD  Component.”  [emphasis 
added]  It  further  states,  “Allegations  of  serious  misconduct  against 
senior  officials  shall  be  vigorously  investigated  by  appropriate 
investigative  organizations.”  The  OIG,  DoD,  is  tasked,  among  other 
things,  to  receive  reports  of  allegations  and  to  provide  oversight  it 
deems  appropriate  on  investigations  conducted  by  the  DoD 
Components.  Agency  “component  designated  officials”  are  required  to 
report  allegations  of  serious  misconduct  within  5  workdays  of  receipt, 
and  “unless  notified  that  the  IG,  DoD  assumes  investigative 
responsibility  for  a  particular  matter,  initiate  or  cause  to  be  initiated 
an  investigation  of  the  issues  raised  in  the  allegation  (s)  [emphasis 
added].  ”  As  stated  above,  this  policy  was  misinterpreted  as  a 
requirement  to  refer  matters  to  the  OIG,  DoD,  for  investigation,  thus 
placing  matters  into  the  wrong  venue  for  resolution  and  sometimes 
causing  delays  in  initiating  investigations. 

•  DoD  Instruction  5505.7,  “Titling  and  Indexing  of  Subjects  of  Criminal 
Investigations  in  the  Department  of  Defense,”  May  14,  1992,  states, 
“The  fact  that  an  investigation  has  started  and  the  identity  of  the 
subject  when  known  shall  be  reported  by  the  investigating  agency  to 
the  Defense  Clearance  and  Investigations  Index  for  indexing.”  The 
OIG,  DIA,  incorporated  this  requirement  into  its  SOP  92-04,  “DoD 
Titling  and  Indexing  of  Subjects  of  Criminal  Investigations  in  the 
Defense  Intelligence  Agency,”  November  4,  1992.  Although  OIG, 
DIA,  investigators  are  classified  as  criminal  investigators  and  argue 
that  their  investigations  are  criminal  investigations,  the  OIG,  DIA,  did 
not  comply  with  either  the  DoDI  5505.7  or  its  own  SOP.  None  of  the 
cases  reviewed  were  indexed  in  the  Defense  Clearance  and 
Investigations  Index. 

•  DoD  Instruction  5505.11,  “Fingerprint  Card  and  Final  Disposition 
Report  Submission  Requirements,”  December  1,  1998,  requires 
fingerprints  and  other  criminal  history  data  to  be  collected  and  reported 
to  the  Federal  Bureau  of  Investigation  for  all  military  subjects  of 
criminal  investigations.  The  OIG,  DIA,  investigators  have  opened 
investigations  of  military  members  involved  in  felony  violations  of  the 
Uniform  Code  of  Military  Justice,  yet  the  OIG,  DIA,  has  no  policy 
addressing  this  requirement.  The  investigators  similarly  have  not 
collected  the  information. 

•  DoD  Directive  1030.1,  “Victim  and  Witness  Assistance,” 

November  23,  1994,  and  DoD  Instruction  1030.2,  “Victim  and 


"Defense  Clearance  and  Investigations  Index,  a  “computerized  central  index  of  investigations  tor 
all  DoD  investigative  activities.”  (DoDI  5505.7,  paragraph  F.4.).  The  Defense  Clearance  and 
Investigations  Index  is  a  comprehensive  tool  used  by  DoD  criminal  investigators,  persoimel 
security  specialists,  and  clearance  adjudicative  personnel  to  locate  investigative  files. 
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Witness  Assistance  Procedures,”  December  23,  1994,  require  heads  of 
Defense  agencies,  among  others,  to  ,  develop  policies  and 
procedures  to  implement  the  victim  and  witness  assistance  program  in 
their  Components ...”  Criminal  investigation  officers  are  to  provide 
the  following  services  to  each  victim  and  wimess  as  appropriate: 
Issuance  of  a  DD  Form  2701,  “Initial  Information  for  Victims  and 
Witnesses  of  a  Crime”;  information  concerning  emergency  medical 
and  social  services;  information  about  restitution  and  other  relief; 
information  to  victims  of  intra-familial  abuse;  information  about 
counseling,  treatment,  and  other  support;  and  notification  concerning 
action  taken  against  an  offender.  Although  most  OIG,  DIA, 
investigations  involved  fraud  in  which  DoD  was  the  “victim,”  its 
investigators  did  pursue  several  crimes  against  persons,  such  as  rape 
and  adultery,  involving  military  members.  The  OIG,  DIA,  has  no 
policy  or  procedural  guidance  implementing  or  referencing  these  DoD 
policies;  therefore,  DoD  victim-witness  policy  was  not  followed  in  the 
cases  reviewed. 

Inattention  to  the  DoD  policy  issuances  involving  criminal  investigative  matters 
further  highlights  the  incongruity  between  the  articulated  mission  of  the  OIG, 
DIA,  investigative  function  and  actual  practice.  Complying  with  the  previously 
discussed  policies  is  not  required  in  administrative  investigations. 

Sufficiency  of  Investigative  Policy.  As  discussed  above,  the  OIG,  DIA,  lacks 
sufficient  criminal  investigative  policy.  When  viewed  as  an  administrative 
investigative  organization,  however,  the  organization  has  policies  that  amply 
address  such  issues  as:  recording  all  complaints,  investigative  report  writing, 
obtaining  affidavits,  reducing  all  investigative  steps  to  writing,  proper  note  taking 
(contemporaneous  notes),  and  source  anonymity  in  investigative  reports. 

Effectiveness  and  Sufficiency  of  Investigative  Casework 


A  judgmental  sample  of  50  investigative  case  files,  comprising  approximately 
10  percent  of  the  total  number  of  investigative  matters  logged  during  FYs  1996 
through  1998,  was  reviewed  during  this  evaluation.  Factors  assessed  include 
investigative  timeliness  (elapsed  calendar  time  start  to  finish),  investigative 
sufficiency  (were  all  logical  and  necessary  leads  run  and  investigative  steps 
taken),  coordination  with  appropriate  collateral  agencies  (were  the  cases  properly 
coordinated  with  other  cognizant  criminal  investigative  and  prosecutive 
authorities),  and  follow-through  (was  appropriate  action  taken). 

Investigative  Timeliness.  Timeliness  of  investigative  reports  was  highlighted  by 
the  Director  and  other  senior  officials  as  an  important  consideration.  Of  the  50 
cases  reviewed,  39  were  closed  investigations,  6  were  closed  zero  files, and  5 
were  investigations  in  progress  at  the  time  of  review.  The  elapsed  time  of  the 
closed  investigations,  from  case  initiation  to  final  report,  ranged  from  2  weeks  to 
48  months,  with  an  average  of  8.4  months.  Review  of  closed  cases  that  had  been 


'^Zero  files,  which  comprised  approximately  20  percent  of  case  openings  in  tlie  fiscal  years 
considered,  were  accomplished  in  1  day. 
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opened  for  greater  than  1  year  disclosed  an  average  age  of  14.4  months.  Some  of 
the  pending  cases  were  joint  investigations  with  other  agencies  (additional 
coordination  required);  while  some  involved  the  collection  and  analysis  of 
voluminous  records.  The  ratio  of  agency  caseload  assigned  each  year  as 
compared  to  the  number  of  investigators  must  certainly  be  considered: 


OIG,  DIA, 
Investigators 

Number  of 
Cases‘^ 

Ratio  of 
Cases  /inv/yr 

FY  1996: 

4.90 

223 

45.5 

FY  1997: 

4.50 

284 

63.1 

FY  1998: 

4.75 

214 

45.1 

Conclusions  concerning  timeliness  are  difficult  to  draw  given  the  widely  disparate 
nature  of  individual  investigations.  For  example,  the  3  years  it  took  to  complete 
an  investigation  of  frequent  flyer  mileage  abuse,  involving  several  interviews  and 
the  collection  and  analysis  of  airline  records,  is  viewed  as  not  being  completed  in 
a  timely  manner.  Conversely,  the  conclusion,  in  1  month,  of  a  case  involving  78 
very  thorough  and  well-documented  interviews  was  exceptionally  responsive. 
Although  DIA  leadership  wants  to  improve  timeliness,  it  is  important  to  note  that 
the  OIG,  DIA,  did  not  develop  standards  or  measurements  for  case  timeliness. 

Investigative  Sufficiency.  The  OIG,  DIA,  investigators  typically  used  interviews 
and  the  collection  and  analysis  of  records  as  their  primary  tools.  For  the  purpose 
of  taking  administrative  or  management  action,  the  case  files  were  complete  and 
thorough.  Affidavits  and  records  of  interview  were  comprehensive,  and  the 
analysis  of  supporting  data  was  typically  presented  logically  and  accurately. 
However,  many  of  the  cases  reviewed  lacked  the  necessary  investigative  steps 
focused  on  the  collection  of  evidence  to  demonstrate  guilt  beyond  a  reasonable 
doubt.  In  theft  investigations,  for  example,  latent  fingerprints  and  trace  evidence 
were  not  collected.  In  one  case,  investigators  never  responded  to  the  scene  of  an 
alleged  theft.  The  DIA  investigators  do  not  maintain  a  complement  of  technical 
evidence  gathering  equipment  and  were  thus  not  in  a  position  to  provide  complete 
criminal  investigative  service.  Moreover,  of  the  50  cases  reviewed,  only  5  were 
presented  to  an  Assistant  United  States  Attorney  or  military  Staff  Judge  Advocate 
for  prosecutive  consideration.  (Note:  Of  the  five  investigations,  two  were  led  by 
other  criminal  investigative  agencies  working  jointly  with  DIA  investigators.) 

Coordination  With  Collateral  Investigative  Agencies.  The  OIG,  DIA,  has  not 
established  jurisdictional  agreements  with  the  MCIOs,  the  DCIS,  or  the  Defense 
Protective  Service.  Within  the  Department  of  Defense,  the  MCIOs  and  the  DCIS 
are  primarily  responsible  for  the  investigation  of  crimes  that  are  not  the  province 
of  other  Federal,  state,  or  local  law  enforcement  agencies.  The  OIG,  DIA,  is 
required  by  policy  to  refer  fraud  matters  to  the  DCIS.  The  MCIOs  investigate 
major  crimes  within  their  respective  Services,  and  Service  policies  require  referral 
of  suspected  criminal  activities  by  service  members  to  them  for  investigation. 
Defense  agencies  normally  refer  criminal  matters  involving  military  members  to 
the  MCIOs  based  on  their  own  individual  policies  and  procedures.  DoD  policy 


"Includes  zero  files  for  which  little  or  no  investigative  fieldwork  was  done,  other  than  recording 
the  infonnation  received. 
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mandating  such  referrals  does  not  exist.  The  MCIOs  frequently  rely  on  their  field 
commanders  and  agents-in-charge  to  foster  relationships  and  local  procedures  that 
ensure  criminal  matters  in  Defense  agency  environments  are  referred  to  them  for 
investigation.  The  remaining  area  of  interest,  where  there  is  no  other  assigned 
DoD  investigative  support,  involves  cases  where  DIA  civilians  or  contractors 
commit  crimes  or  violate  policies,  and  the  DCIS  declines  to  investigate. 

Review  of  the  50  selected  cases  revealed  inconsistency  in  DIA  referrals  to 
cognizant  criminal  investigative  agencies;  some  cases  were  promptly  and  properly 
referred  to  the  DCIS  or  the  appropriate  MCIO,  others  were  not.  The  following 
table  portrays  a  selection  of  cases  where  primary  criminal  investigative 
responsibility  lies  outside  the  DIA.  The  result  is  that  some  cases  that  may  have 
had  prosecutive  merit  were  never  evaluated  from  that  perspective,  nor  was 
evidence  collected  that  would  likely  sustain  a  criminal  conviction.  In  addition  to 
jurisdiction  issues  involving  the  MCIOs,  property  crimes  occurring  within  the 
Pentagon  affect  the  mission  of  the  Defense  Protective  Service. 
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Criminal  Cases  With  Primary  Investigative  Responsibility  Outside  the  DIA 


Alleged  Offense 

Primary  Invest.  Agency 

Referred?*'' 

Navy  O-6/false  statements  re: 

NCIS 

No.  Handled  as  administrative  matter  by 

household  goods  shipment 

DIA  investigators. 

Conflict  of  Interest  in  a  procurement 
action 

DCIS 

Yes. 

Army  0-6  soliciting  pornography  to 

USACIDC 

No.  Handled  administratively  by  DIA 

subordinates 

inspectors  (not  investigators). 

Army  0-4  converts  government 

USACIDC 

No.  DIA  investigation  was  very 

frequent  flyer  miles  for  personal 

thorough.  Member  received  General 

travel 

Officer  written  reprimand. 

Contract  improprieties/conflict  of 
interest  by  senior  DIA  official 

DCIS 

Referred  to  DoD  IG. 

Army  member  filing  false  claims 

USACIDC 

Yes. 

Army  member  AWOL 

USACIDC 

No. 

Army  member  violated  regulation  in 
taking  language  test/false 
statements/forgery 

USACIDC 

No. 

Time  and  attendance  fraud  by  senior 

DCIS 

Referred  to  DoD  IG,  who  referred  to 

civilian 

DCIS. 

Time  and  attendance  fraud 

DCIS 

No.  Would  likely  have  been  declined 
based  on  prosecutive  merit. 

Army  attache/improprieties  with 
working  fund 

USACIDC 

Yes. 

Army  0-6/false  travel  claims 

USACIDC 

Yes. 

Time  and  attendance  fraud 

DCIS 

No. 

False  travel  voucher/USAF  0-6 

AFOSI 

No. 

Theft  of  government  computer 

DCIS 

No. 

USACIDC  U.S.  Army  Criminal  Investigation  Command 

NCIS  Naval  Criminal  Investigative  Service 

AFOSI  Air  Force  Office  of  Special  Investigations 


‘“DoD  Instruction  5505.2  requires  Defense  agencies  to  refer  fraud  matters  to  tlie  Defense  Criminal 
Investigative  Service.  "Referred"  in  this  context  incorporates  that  requirement,  but  also  expands 
it  to  include  coordination  with,  and  referral  to  any  Defense  Criminal  Investigative  Organization 
having  authorized  law  enforcement  jurisdiction  for  other  case  types  as  well.  It  must  be  noted  that 
there  is  no  requirement  in  present  DoD  policy  for  DoD  agencies  to  refer  non-fraud  allegations 
elsewhere  for  investigation.  For  example,  the  AFOSI  is  authorized  and  empowered  by  Air  Force 
policy  to  conduct  a  criminal  investigation  involving  an  Air  Force  officer  assigned  to  a  Defense 
Attach6  Office  overseas;  however,  there  is  no  DoD  policy  requiring  the  OIG,  DIA,  to  refer  such 
a  case  to  the  AFOSI.  Given  the  availability  of  criminal  investigative  resources,  historical 
expertise  in  die  military  criminal  justice  community,  lack  of  military  command  authority  in  the 
DIA,  as  well  as  other  factors,  such  an  investigation  would  arguably  be  conducted  more 
appropriately  by  the  AFOSI. 
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Followup  on  Action  Taken  Within  DIA.  An  area  sometimes  neglected  by 
investigative  agencies,  the  OIG,  DIA,  routinely  followed  through  with  DIA 
management  to  ensure  that  action  was  taken.  Cases  involving  the  improper 
obtaining  of  DIA  funds,  for  example,  maintained  visibility  with  investigators  until 
recoupment  action  was  complete. 

Recommendations,  Management  Comments,  and  Evaluation 
Response 

D.l.  We  recommend  that  the  Director,  Defense  Intelligence  Agency: 

a.  Develop,  in  coordination  with  the  Inspector  General,  Defense 
Intelligence  Agency,  policies  and  procedures  to  ensure  that  complaints  more 
appropriately  addressed  by  Defense  Intelligence  Agency  managers  are 
assigned  accordingly. 

DIA  Comments.  The  DIA  concurred. 

b.  To  preserve  the  independence  of  the  Inspector  General 
investigative  function  and  its  role  as  an  oversight  organization,  develop,  in 
coordination  with  the  Inspector  General,  Defense  Intelligence  Agency,  policies 
and  procedures  to  ensure  that  operational  tasks  are  properly  assigned  to  the 
Defense  Intelligence  Agency  functional  managers  rather  than  the  Office  of  the 
Inspector  General,  Defense  Intelligence  Agency. 

DIA  Comments.  The  DIA  concurred. 

D.2.  We  recommend  that  the  Inspector  General,  Defense  Intelligence 
Agency; 


a.  Conduct  an  assessment  of  the  Defense  Intelligence  Agency 
criminal  (vice  administrative)  investigative  requirements  (including  proactive 
needs)  in  coordination  with  the  DCIOs,  and  adjust  staffing  and  job  series  of 
the  investigative  staff  members  accordingly.  The  assessment  should  take  into 
consideration  the  need  to  conduct  proactive  crime  prevention  as  well  as 
reactive  administrative  investigative  efforts. 

DIA  Comments.  The  DIA  concurred. 

b.  If  a  decision  is  made  to  retain  1811  series  investigators  in  the 
Office  of  the  Inspector  General,  Defense  Intelligence  Agency,  implement 
criminal  investigative  policies  and  procedures  responsive  to  DoD  policy,  to 
address  at  a  minimum; 

(1)  collection  and  preservation  of  physical  evidence; 

(2)  firearms,  non-lethal  devices,  and  defensive  measures; 

(3)  technical  investigative  equipment; 
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(4)  physical  fitness  requirements; 

(5)  24-hour  duty  investigator  requirement; 

(6)  surveillance; 

(7)  use  of  contingency  funds; 

(8)  undercover  operations; 

(9)  execution  of  search  warrants;  and 

(10)  human  sources/informants. 

DIA  Comments.  The  DIA  concurred. 

c.  Coordinate  a  plan  with  the  Military  Criminal  Investigative 
Organizations  and  the  Defense  Protective  Service,  to  investigate  allegations 
involving  criminal  activities  by  military  personnel  assigned  to  the  DIA,  and 
crimes  taking  place  at  the  Pentagon,  respectively. 

DIA  Comments.  The  DIA  concurred. 

d.  Train  its  investigators  on  the  proper  interpretation  of  DoD 
Instructions  5240.4,  5505.2,  and  5505.6,  and  the  responsibilities  associated 
with  them. 

DIA  Comments.  The  DIA  concurred. 

e.  Coordinate  with  Defense  Intelligence  Agency  senior 
management,  a  proactive  investigative  program  to  address  key  Defense 
Intelligence  Agency  programs  most  susceptible  to  fraud,  waste,  and  abuse. 

DIA  Comments.  The  DIA  concurred. 

f.  Develop  appropriate  investigative  management  processes  and 
effectiveness  measurements  to  maximize  desirable  outcomes. 

DIA  Comments.  The  DIA  concurred. 

g.  Prioritize  investigative  matters  and  develop  a  process  to  ensure 
that  cases  receive  attention  according  to  their  priority. 

DIA  Comments.  The  DIA  concurred. 
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Appendix  A.  Evaluation  Process 


Scope 


We  reviewed  the  operation  of  the  OIG,  DIA,  for  the  fiscal  years  1996  through 
1998.  We  evaluated  reports,  policies  and  procedures,  personnel,  and  the 
organizational  structure  for  audit,  inspections,  and  investigations,  and  the 
management  and  administrative  functions.  We  reviewed  the  OIG,  DIA,  in  its 
organizational  responsibilities  to  the  Director  and  his  staff  and  other  operational 
directorates  in  DIA.  We  contacted  past  and  present  DIA  personnel  to  discuss  the 
anonymous  allegations  on  the  OIG,  DIA,  working  environment. 

Methodology 


Quality  Control  Review  of  Audit  Function.  Our  review  of  the  quality  control 
system  was  conducted  in  conformity  with  standards  and  guidelines  established  by 
the  President’s  Council  on  Integrity  and  Efficiency  Guide  for  conducting  External 
Quality  Control  Reviews  of  Audit  Organizations.  We  tested  compliance  with  the 
OIG  system  of  quality  control  to  the  extent  we  considered  appropriate.  Those 
tests  included  a  review  of  audits.  We  considered  the  President’s  Council  on 
Integrity  and  Efficiency’s  policy  statements  on  quality  control  and  external 
reviews,  dated  August  8,  1989,  and  April  3,  1997.  Those  statements  indicate  that 
OIG  quality  control  policies  and  procedures  should  be  appropriately 
comprehensive  and  suitably  designed  to  provide  reasonable  assurance  that  the 
objectives  of  quality  control  will  be  met.  They  also  recognize  that  the  OIG 
system  of  quality  control  depends  on  various  factors  such  as  the  size  of  the  OIG, 
the  nature  of  the  work,  and  its  organizational  structure.  Our  review  would  not 
necessarily  disclose  all  weaknesses  in  the  system  or  all  instances  of  noncompliance 
with  it  because  our  review  was  based  on  selective  tests. 

We  evaluated  the  independence  of  the  audit  organization  by  obtaining  and 
reviewing  organizational  charts,  policies  for  the  OIG,  DIA,  and  DIA,  and  budget 
procedures  for  handling  the  resources.  We  assessed  the  audit  policies  and 
procedures  in  comparison  to  the  government  auditing  standards.  We  reviewed  the 
audit  planning  process  to  include  the  identification  of  auditable  entities  and  risk 
assessment  process.  We  evaluated  the  quality  assurance  program  for  its  aljility  to 
ensure  quality  in  the  audit  product.  We  checked  the  auditor  training  requirements 
by  reviewing  the  individual  (training)  development  plans  and  the  actual  training 
received  by  the  auditors.  To  determine  whether  the  audit  effort  complied  with 
auditing  standards,  we  selected  5  working  paper  packages  of  the  20  audits  that 
resulted  in  audit  reports  for  the  period  under  review.  The  judgmentally  selected 
audits  represented  varied  performance  and  financial  audits  and  the  work  of  all 
members  of  the  audit  staff. 

Interviews.  From  the  OIG,  DIA,  staff,  we  interviewed  the  IG;  DlGs  for  Audit 
and  Inspections,  for  Management  and  Administration,  and  for  Investigations;  the 
audit  staff;  the  investigative  staff;  three  inspectors;  a  staff  assistant;  a  nianagement 
staff  officer;  and  an  intelligence  oversight  staff  officer.  We  also  interviewed 
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former  OIG,  DIA,  employees  who  were  Assistant  IGs  for  Audits,  and  for 
Inspections,  and  a  former  inspector.  From  the  command  element,  we  interviewed 
the  Director,  Deputy  Director,  and  former  Chief  of  Staff  and  the  Director  of 
Operations,  DIA,  who  served  during  the  period  identified  for  our  evaluation. 

Other  DIA  interviewees  included  the  General  Counsel,  as  well  as  representatives 
of  the  DIA  Counterintelligence  and  Security  Activity.  Non-DIA  interviewees 
included  special  agents  from  the  Defense  Criminal  Investigative  Service  and  the 
U.S.  Customs  Service,  and  the  Counsel  to  the  Assistant  to  the  Secretary  of 
Defense  for  Intelligence  Oversight. 

Computer-Processed  Data.  We  used  the  OIG,  DIA,  database  that  accumulates 
information  for  all  activity  projects  in  the  organization.  We  did  not  test  the 
validity  of  the  data  produced  by  the  system  because  we  were  able  to  corroborate 
some  of  the  data  with  other  records  or  because  of  the  minimal  risk  assigned  to  the 
data  reports  that  would  change  the  results  of  the  review. 

To  support  OIG  processes  and  events,  we  evaluated  internal  and  external  DIA 
e-mail.  We  determined  during  our  review  that  the  current  DIA  e-mail  system, 
Microsoft  Outlook  (installed  in  1997),  has  an  established  default  priority  to  create 
messages  that  can  be  edited  after  transmission  by  the  original  author,  receiver,  or 
any  subsequent  receivers  (via  copy  or  forwarding  feature).  The  majority  of 
e-mails  on  the  Microsoft  Outlook  system  are  prepared  under  the  default  priority. 
Because  we  considered  the  e-mails  provided  directly  to  us  as  evidence  to 
substantiate  certain  matters,  we  used  other  means  to  establish  the  accuracy  of  the 
communication  if  the  information  was  crucial  to  the  results  of  our  review. 

Evaluation  Period  and  Standards.  We  performed  the  evaluation  at  the  OIG, 
DIA,  from  October  1998  through  May  1999  and  we  included  tests  of  management 
controls  considered  necessary  to  understand  the  OIG,  DIA. 

Management  Control  Program 

DoD  Directive  5010.38,  “Management  Control  (MC)  Program,”  August  26, 

1996,  requires  DoD  organizations  to  implement  a  comprehensive  system  of 
management  controls  that  provides  reasonable  assurance  that  programs  are 
operating  as  intended  and  to  evaluate  the  adequacy  of  the  controls. 

Scope  of  Review  of  the  Management  Control  Program.  We  reviewed  the 
adequacy  of  the  OIG,  DIA,  management  controls  over  the  management  and 
administration  of  the  audit,  inspection,  and  investigative  functions. 

Adequacy  of  Management  Controls.  We  identified  management  control 
weaknesses  for  the  OIG,  DIA.  The  audit,  inspection,  and  investigative  functions, 
which  include  assessing  the  management  control  programs  of  the  DIA  components 
that  they  audit,  inspect,  or  investigate,  were  not  adequate  to  ensure  that  the 
primary  mission  of  the  OIG,  DIA,  was  accomplished  in  an  efficient  and  effective 
manner.  Recommendations  B.l,,  B.2.a.  through  B.2.C.,  C.l.a.  through  C.l.c., 
C.2.a.  through  C.2.C.,  C.2.e.,  D.I.,  D.2.b.,  D.2.C.,  and  D.2.e.  through  D.2.g., 
if  implemented,  will  improve  the  operation  of  the  OIG,  DIA.  A  copy  of  the 
report  will  be  provided  to  the  senior  official  responsible  for  management  controls 
in  the  DIA. 


33 


Adequacy  of  Management’s  Self-Evaluation.  The  OIG,  DIA,  as  an  assessable 
unit  does  not  have  an  acceptable  self-evaluation  system  that  identifies  the 
management  controls  that  need  to  be  reviewed  on  a  regular  basis  and  tests  them. 
Therefore,  DIA  did  not  identify  or  report  the  management  control  weaknesses 
identified  by  the  evaluation. 

Summary  of  Prior  Coverage 

The  (former)  Office  of  Assistant  Inspector  General,  DoD,  for  Audit  Policy  and 
Oversight  performed  a  review-inspector  General,  DoD,  APO  Report  No.  94-015, 
“Report  on  the  External  Quality  Control  Review  of  the  Defense  Intelligence 
Agency  Inspector  General  Audit  Organization,”  August  30,  1994.  No  other 
coverage  of  the  subject  organization  has  been  conducted  in  the  past  5  years. 
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Appendix  B.  Organizational  Chart  of  the  Office 

of  the  Inspector  General,  Defense 
Intelligence  Agency 

As  of  February  1999 
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Organizational  blocks  depict  military  or  civilian  grade  level  with  position  titles: 

•  O  =  Officer 

•  EP  =  Execution  Position 

•  W  =  Warrant 

•  E  =  Enlisted 

•  GG  =  DIA  Pay  Plan,  equivalent  to  GS,  General  Schedule 
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Appendix  C.  Excerpts  from  “Handbook  of 

Occupational  Groups  and  Families” 

GS-1800  -  INVESTIGATION  GROUP 

The  group  includes  all  classes  of  positions  the  duties  of  which  are  to  advise  on, 
administer,  supervise,  or  perform  investigation,  inspection,  or  enforcement  work 
primarily  concerned  with  alleged  or  suspected  offenses  against  the  laws  of  the 
United  States,  or  such  work  primarily  concerned  with  determining  compliance 
with  laws  and  regulations. 

The  job  series  in  this  group  are: 

1801  -  General  Inspection,  Investigation,  and  Compliance  Series 

This  series  includes  positions  the  primary  duties  of  which  are  to  administer, 
coordinate,  supervise  or  perform  inspectional,  investigative,  analytical,  or 
advisory  work  to  assure  understanding  of  and  compliance  with  Federal  laws, 
regulations,  or  other  mandatory  guidelines  when  such  work  is  not  more 
appropriately  classifiable  in  another  series  either  in  the  investigation  Group, 
GS-1800  or  in  another  occupational  series. 

1802  -  Compliance  Inspection  and  Support  Series 

This  series  includes  positions  which  perform  or  supervise  inspectional  or  technical 
support  work  in  assuring  compliance  with  or  enforcement  of  Federal  laws, 
regulations,  or  other  mandatory  guidelines  and  which  are  not  classifiable  in 
another,  more  specific,  occupational  series.  The  work  requires  a  knowledge  of 
prescribed  procedures,  established  techniques,  directly  applicable  guidelines,  and 
pertinent  characteristics  of  regulated  items  or  activities. 

1810  -  General  Investigating  Series 

This  series  includes  positions  that  involve  planning  and  conducting  investigations 
covering  the  character,  practices,  suitability,  or  qualifications  of  persons  or 
organizations  seeking,  claiming,  or  receiving  Federal  benefits,  permits,  or 
employment  when  the  results  of  the  investigation  are  used  to  make  or  invoke 
administrative  judgments,  sanctions,  or  penalties.  These  positions  require 
primarily  a  knowledge  of  investigative  techniques;  a  knowledge  of  the  laws,  rules, 
regulations,  and  objectives  of  the  employing  agency;  skill  in  interviewing, 
following  leads,  researching  records,  and  preparing  reports;  and  the  ability  to 
elicit  information  helpful  to  the  investigation  from  persons  in  all  walks  of  life. 

1811  -  Criminal  Investigating  Series 

This  series  includes  positions  that  involve  planning  and  conducting  investigations 
relating  to  alleged  or  suspected  violations  of  criminal  laws.  These  positions 
require  primarily  a  knowledge  of  investigative  techniques  and  a  knowledge  of  the 
laws  of  evidence,  the  rules  of  criminal  procedure,  and  precedent  court  decisions 
concerning  admissibility  of  evidence,  constitutional  rights,  search  and  seizure  and 
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related  issues;  the  ability  to  recognize,  develop  and  present  evidence  that 
reconstructs  events,  sequences,  and  time  elements,  and  establishes  relationships, 
responsibilities,  legal  liabilities,  conflicts  of  interest,  in  a  manner  that  meets 
requirements  for  presentation  in  various  legal  hearings  and  court  proceedings;  and 
skill  in  applying  the  techniques  required  in  performing  such  duties  as  maintaining 
surveillance,  performing  undercover  work,  and  advising  and  assisting  the  U.S. 
Attorney  in  and  out  of  court. 
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Appendix  D.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 


Department  of  the  Army 

Commander,  Criminal  Investigation  Command 


Department  of  the  Navy 

Director,  Naval  Criminal  Investigative  Service 


Department  of  the  Air  Force 

Commander,  Air  Force  Office  of  Special  Investigations 


Other  Defense  Organization 

Director,  Defense  Intelligence  Agency 

Inspector  General,  Defense  Intelligence  Agency 


Congressional  Committees 

Senate  Permanent  Select  Committee  on  Intelligence 
House  Permanent  Select  Committee  on  Intelligence 
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Defense  Intelligence  Agency  Comments 


DEFENSE  INTELLIGENCE  AGENCY 

WASHINGTON,  D  C  2034^ 


U-0453/IG  7  January  2000 

MEMORANDUM  FOR  DEPUTY  ASSISTANT  INSPECTOR  GENERAL,  AUDIT 

POLICY  AND  OVERSIGHT,  DEPARTMENT  OF  DEFENSE 

SUBJECT:  (U)  Evaluation  Report  on  Onicc  of  the  Inspector  General,  Defense  Intelligence 
Agency  (Project  No.  80C-9020) 

Reference:  (U)  Your  memorandum,  subject  as  above,  23  November  1999. 

1.  (U)  As  requested  in  referenced  memorandum,  comments  relating  to  recommendations 
intended  for  the  Director,  Defense  Intelligence  Agency  (DIA),  are  at  enclosure  1;  comments 
relating  to  the  recommendations  intended  for  the  Inspector  General  (IG),  DIA.  are  at  enclosure  2. 

2.  (U)  We  believe  that  the  suggestions  offered  in  your  report  will  help  to  enhance  the  operations 
of  the  DIA  IG,  We  would  like  to  thank  the  members  of  the  evaluation  team  for  their 
professionalism  and  dedication  throughout  this  review.  Should  you  have  any  questions 
regarding  this  reply,  please  contact  Mr.  Warren  A.  Uthc,  Inspector  General,  at  (202)  231-1010. 

— — 

2  Enclosures  a/s  THOMAS  R.  WILSON 

Vice  Admiral,  USN 
Director 


Original  management  comments  were  marked  “For  Official  Use  Only.”  On  January  28, 
2000,  DIA  agreed  to  the  removal  of  the  “For  Official  Use  Only”  marking  from  this 
response  to  the  draft  report  in  order  to  include  it  in  our  final  report. 
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(U)  RECOMMENDATIONS  FOR  THE  DIRECTOR 


B. l.  We  recommend  that  the  Director,  Defense  Intelligence  Agency,  direct  that  the 

Inspector  General  is  the  selection  authority  and  the  Director  is  the  approval  authority 
for  grade  level  15  positions  to  be  filled  by  hiring,  reassignment,  or  promotion  to  the 
supervisory  or  managerial  role. 

DIA  Response:  Concur  with  intent  of  recommendation.  However,  DIA  Manual  (DIAM) 
22-23  provides  for  all  Agency  Key  Components,  to  include  the  DIA  Inspector  General 
(IG),  to  select  and  approve  all  GG-15  personnel. 

C. l.  We  recommend  that  the  Director,  Defense  Intelligence  Agency: 

C.l.a.  Revise  regulations  to  provide  — ■ 

CJ.a.(l)  A  separate  line  item  for  the  Office  of  the  Inspector  General, 
Defense  Intelligence  Agency,  operating  budget  (to  include 
training)  In  the  Defense  Intelligence  Agency  budget. 

DIA  Response:  Concur  in  part.  The  DIA  operating  budget  contains  a 
separate  budget  record  for  the  IG  within  the  overall  Command 
Element  portion  of  the  DIA  Program.  In  past  years,  the  Agency  has 
adequately  funded  IG  operations  (to  include  training),  subject  to  the 
same  constraints  as  the  other  elements  of  the  Agency.  To  compensate 
for  recent  cutbacks  in  overall  Agency  training  funds,  the  IG  budget 
record  for  FYOl  and  beyond  contains  proportionately  increased 
funding  to  reflect  the  need  for  satisfying  requirements  for  auditor 
continuing  professional  education,  as  well  as  essential  inspector, 
investigator,  and  management  support  staff  training. 

C.l  .a.(2)  Sole  authority  to  the  Inspector  General,  Defense  Intelligence 
Agency,  within  applicable  laws  and  regulations,  to  manage  the 
funds  appropriated  for  the  Office  of  the  Inspector  General. 

DIA  Response:  Concur.  DIA  Regulation  46-1  authorizes  the  DIA  IG 
to  manage  the  funds  allotted  from  the  DIA  operating  budget. 


Enclosure  1  to  U-0453/IG 
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C.l.b*  Establish  procedures  as  outlined  in  the  Inspector  General,  DoD, 
memorandum,  July  3, 1997,  that  the  - 

C.l.b.(l)  Inspector  General,  Defense  loitelligence  Agency,  be  g^ven  the 

authority  to  accept  or  reject  management’s  request  for  Office  of 
Inspector  General  resource  support  to  operational  activities. 

DIA  Response:  Concur  In  response  to  the  cited  memorandum,  the 
former  Director,  DIA  instructed  the  Agency  to  comply  with  the 
guidance  provided.  DIAM  4(V1  is  being  updated  and  will  include 
speciHc  guidance  concerning  Agency  operational  support.  Estimated 
completion:  Hun  00. 

C.l.b.(2)  Defense  Intdligenoe  Agency  management  be  g^ven  the  authority  to 
elevate  any  Flection  for  support  to  operatiottal  activities  by  the 
Inspector  General,  Defense  Intelligence  Agency,  to  the  Director, 
Defense  IntelHgence  Agency,  for  resolution. 

DIA  Response:  Concur.  See  response  to  recommendation  C.l.b.(l). 

C. I.C.  Terminate  the  participation  of  the  Office  of  the  Inspector  General,  Defense 

Intelligence  Agency,  in  the  approval  procedure  for  acquisitions  and  require 
that  the  Office  of  the  Inspector  General  periodically  audit  the  procurement 
procedures  and  the  related  management  controls. 

DIA  Response:  Concur.  A  revision  to  DIAM  44-1  is  being  staffed  to  reflect  this 
change.  In  addition,  the  DIA  IG  has  added  procurement  procedures  and  related 
management  controls  to  the  list  of  auditable  entities.  Estimated  completion:  1 
May  00. 

D.l.  We  recommend  that  the  Director,  Defense  Intelligence  Agency: 

D. l.a.  Develop,  in  coordination  with  the  Inspector  General,  Defense  Intelligence 

Ageney,  policies  and  procedures  to  ensure  that  complaints  more 
appropriately  addressed  by  Defense  Intelligence  Agency  managers  are 
assigned  accordingly. 

DIA  Response:  Concur.  In  coordination  with  the  Director,  DIA  the  IG  recently 
implemented  procedures  to  ensure  all  complaints  more  appropriately  addressed  by 
DIA  managers  are  referred  to  Agency  management  for  review,  determination  of 
validity,  and  for  corrective  action,  as  necessary.  The  Director,  DIA  will  issue  a 
companion  policy  statement,  and  the  Inspector  General  will  ensure  that  IG 
Standard  Operating  Procedures  are  updated  accordingly.  Estimated  completion: 

1  Apr  00. 
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D.l.b.  To  preserve  the  independence  of  the  Inspector  General  investigative  function 
and  its  role  as  an  oversight  organization,  develop,  in  coordination  with  the 
Inspector  General,  Defense  Intelligence  Agency,  policies  and  procedures  to 
ensure  that  operational  tasks  are  properly  assigned  to  the  Defense 
Intelligence  Agency  functional  managers  rather  than  the  Office  of  the 
Inspector  General,  Defense  Intelligence  Agency. 

DIA  Response;  Concur.  See  response  to  Recommendation  D.l.a. 
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(U)  RECOMMENDATIONS  FOR  THE  INSPECTOR  GENERAL 


B.2.  We  recommend  that  the  Inspector  General,  Defense  Intelligence  Agency: 

B.2.a.  Comply  with  Defense  Intelligence  Agency  Regulation  49-5,  “Manpower  and 
Organization,”  October  8, 1990,  in  assessing  the  Office  of  Inspector 
General  organization  on  developing  a  more  effective  supervisor-to- 
subordinate  ratio, 

DIA  Response:  Concur.  Personnel  staffing  action  is  underway  to  reduce 
supervisor-to-subordinate  span  of  control  to  the  ratio  recommended  in  the 
regulation.  Estimated  completion:  1  Mar  00. 

B.2,b.  Clarify  the  planning  procedures  for  the  audit,  inspection  and  investigative 
functions  to: 

B.2.b.(l)  Identify  the  optimum  level  of  staffing  required  to  effectively 

supervise  and  execute  the  proposed  annual  plan  and  include  the 
staff  levels  in  the  annual  plan, 

DIA  Response:  Concur  The  Fiscal  Year  (FY)  2000  Annual  Plan 
reflects  only  those  projects  that  can  reasonably  be  supported  by 
assigned  resources  -  recognizing  that  gaps  in  military  fills,  as  well  as 
unanticipated  priority  reviews,  cannot  be  predicted  with  complete 
accuracy.  All  future  plans  will  reflect  this  approach  as  well 

B.2.b.(2)  Include  a  practice  to  maintain  a  current  status  of  the  annual  plan 
and  report  mid-year  to  the  Director,  Defense  Intelligence  Agency, 
on  the  status  of  the  annual  plan. 

DIA  Response:  Concur.  Beginning  with  FYOO,  the  Defense 
Intelligence  Agency  (DIA)  Inspector  General  (IG)  will  provide  a 
mid-year  status  of  the  annual  plan  to  the  Director.  DIA.  It  will 
identify  completed,  ongoing,  deleted,  and  additional  projects.  The 
appropriate  DIA  IG  Standard  Operating  Procedure  (SOP)  will  be 
updated  accordingly.  Estimated  completion:  I  May  00 

B.2.b.(3)  Formally  document  at  the  completion  of  each  fiscal  year  an 

assessment  of  actual  performance  compared  to  the  annual  plan 
and  provide  accompanying  explanations  for  the  exceptions  to  the 
Director,  Defense  Intelligence  Agency. 
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DIA  Response;  Concur  The  FY99  Progress  Report  includes  this 
assessment.  All  future  progress  reports  will  conform  as  well. 

B. 2.C.  Implement  a  management  control  self-assessment  process  that  effectively 

addresses  and  tests  the  Office  of  the  Inspector  General,  Defense  Intelligence 
Agency,  management  controls. 

DIA  Response;  Concur,  The  DIA  IG  recently  embarked  upon  a  full  business 
process  review  of  all  its  operations.  An  effective  self-assessment  program  will 
be  implemented  as  pan  of  this  initiative.  A  DIA  IG  SOP  will  be  developed  to 
document  and  guide  the  self-assessment  program.  Estimated  completion:  1  Jul 
00, 

C.2.  We  recommend  that  the  Inspector  General,  Defense  Intelligence  Agency: 

C. 2.a  Prepare  and  use  the  Individual  Development  Plans  to  develop  the  annual 

training  budget  and  to  manage  the  requirement  for  continuing  professional 
education  according  to  the  generally  accepted  government  auditing 
standards. 

DIA  Response;  Concur  with  intent  of  recommendation.  The  IG  Individual 
Development  Plans  (IDPs)  have  always  been  used  to  manage  continuing 
professional  education.  Office-wide  seminars  such  as  fraud  detection. 
Government  Performance  and  Results  Act  education,  and  reprisal  training  arc 
also  integrated  into  the  annual  IG  training  requirements.  The  timelines  of  the 
fiscal  programming  process  come  several  years  in  advance  of  budget  execution, 
and  thus  current  IDPs  cannot  be  used  as  a  viable  tool  for  developing  the 
program-training  budget.  However,  IDPs  are  used  to  manage  the  annual 
training  funds  allocation. 

C.2.b.  Arrange  regularly  scheduled  awareness  training  for  the  audit  staff  on  the 

requirements  for  audit  responsibility,  due  professional  care,  audit  planning, 
supervision,  working  paper  preparation,  collection  of  evidence, 
responsibility  in  detecting  fraud,  referring  suspected  illegal  acts  to  the 
proper  authorities,  reporting  on  illegal  acts,  and  reports  on  performance 
audits  according  to  the  generally  accepted  government  auditing  standards. 

DIA  Response;  Concur.  Basic  fraud  awareness  training  was  accomplished  in 
Aug  99.  Ail  of  our  professional  auditors  have  been  trained  in  the  areas  cited, 
but  we  will  establish  a  formal  awareness/refresher  training  program  for  fraud 
and  other  specific  functional  areas  for  the  audit  staff.  Estimated  completion: 
UunOO. 
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C.2.C.  Amend  the  Internal  Audit  Manual,  January  10, 19^,  to  show: 

C.2.c.(l)  The  audit  program  Is  a  key  document  to  show  the  course  of  an 
audit  and  any  addition,  ddetions,  or  changes  are  to  be 
accompanied  by  an  explanation  and  approved  by  the  audit 
supervisor. 

DIA  Response:  Concur.  Internal  Audit  Manual  to  be  amended  as 
recommended  Estimated  Completion;  1  Feb  00. 

C.2.c.(2)  The  auditor’s  responsibility  in  detecting  fraud  is  to: 

(a)  Provide,  through  the  design  of  the  audit  steps,  reasonable 
assurance  about  the  auditee’s  compliance  with  applicable 
laws,  regulations,  and  other  requirements. 

(b) Propcrly  document  any  indications  of  illegal  acts  and  report 
them  to  the  proper  authorities,  not  the  wrongdoer. 

(c)  Coordinate  any  audit  reports  with  indications  of  potential 
illegal  acts  or  related  to  an  area  under  investigation  or 
litigation  with  the  cogni2ant  investigative  or  prosecutive 
organization  before  issuing  the  report. 

DIA  Response:  Concur.  Internal  Audit  Manual  to  be  amended 
as  recommended.  Estimated  completion:  1  Feb  00. 

C.2.d.  Provide  refresher  training  for  the  Office  of  the  Inspector  General’s  staff  on 
the  requirements  for  all  working  pap^  content,  the  responsibility  and 
determination  for  destruction  of  records,  and  the  retention  of  the  worldng 
paper  records. 

DIA  Response:  Concur.  Estimated  completion:  1  Apr  00 

C.2.e.  Maintain  a  permanent  file  of  the  management  control  programs  and  annual 
statements  of  assurance  for  the  assessable  units  within  Defense  Intelligence 
Agency  and  use  the  information  in  preparing  the  Office  of  the  Inspector 
General  annual  program  plan  and  individual  project  plans. 
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DIA  Response:  Concur.  The  current  annual  statement  of  assurance  has  been 
retained  and  a  permanent  file  of  assessable  DIA  units*  management  control 
programs  will  be  established.  The  IG  SOP  will  be  updated  to  reflect  that  they  will 
be  used  in  preparing  annual  and  project  plans.  Estimated  completion: 

1  Apr  00. 

D.2.  We  recommend  that  the  Inspector  Genera],  Defense  Intelligence  Agency: 

D.2.a.  Conduct  an  assessment  of  the  Defense  Intelligence  Agency  criminal  (vice 
administrative)  investigative  requirements  (including  proactive  needs)  in 
coordination  with  the  DCIOs,  and  adjust  st^ng  and  job  series  of  the 
investigative  staff  members  accordingly.  The  assessment  should  take  into 
consideration  the  need  to  conduct  pro-active  crime  prevention  as  well  as 
reactive  administrative  investigative  efforts. 

DIA  Response:  Concur.  The  recommended  assessment  will  be  conducted  as 
quickly  as  practicable.  The  IG  will  ask  independent,  external  experts  to  jointly 
assess  the  investigative  requirements  of  DIA.  The  assessment  will  include  both  a 
full  review  of  investigative  cases  over  recent  years,  and  an  evaluation  of  the 
current  case  workload.  Estimated  completion:  1  Jun  00. 

D.2.b.  If  a  decision  is  made  to  retain  ISll  series  investigators  in  the  Office  of  the 
Inspector  General,  Defense  Intelligence  Agency,  implement  criminal 
investigative  policies  and  procedures  responsive  to  DoD  policy,  to  address  at 
a  minimum:  (all  items/requfrements  listed  as  sub-paragraphs  to  this 
recommendation) 

DIA  Response:  Concur.  We  will  implement  all  required  and  appropriate 
policies  and  procedures,  following  the  results  of  the  assessment. 

D.2.C.  Coordinate  a  plan  with  the  Military  Criminal  Investigative  Organizations 
and  the  Defense  Protective  Service,  to  investigate  allegations  involving 
criminal  activities  by  military  personnel  assigned  to  the  DIA,  and  crimes 
taking  place  at  the  Pentagon,  respectively. 

DIA  Response:  Concur.  We  have  a  close  and  continual  working  relationship 
with  all  military  criminal  investigative  organizations,  particularly  the  Defense 
Criminal  Investigative  Service  (DCIS).  Discussions  are  well  under  way  with 
DCIS,  and  others  will  follow  as  quickly  as  possible.  Estimated  completion: 

1  Jun  00. 

D.2.d.  Train  its  investigators  on  the  proper  interpretation  of  DoD  Instructions 
5240.4, 5505.2,  and  5505.6,  and  the  responsibilities  associated  with  them. 
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DIA  Response:  Concur.  Investigators  will  be  trained  on  the  interpretation  of 
these  DoD  instructions  as  articulated  in  tltis  report.  Estimated  completion: 

3i Jan  00 

D.2.e.  Coordinate  with  Defense  Intelligence  Agency  senior  management,  a 

proactive  investigative  program  to  address  key  Defense  Intelligence  Agency 
programs  most  susceptible  to  fVaud,  waste,  and  abuse. 

DIA  Response:  Concur  Estimated  completion:  29  Feb  00 

D.2.f,  Develop  appropriate  investigative  management  processes  and  effectiveness 
measurements  to  maximize  desirable  outcomes. 

DIA  Response;  Concur  Measurable  objectives  will  be  developed  and  tracked 
so  that  the  outcome  of  the  investigative  program  can  be  evaluated  for  its 
effectiveness  Estimated  completion:  29  Apr  00 

D.2.g.  Prioritize  investigative  matters  and  develop  a  process  to  ensure  that  cases 
receive  attention  according  to  their  priority. 

DIA  Response;  Concur  The  current  IG  SOP  indicates  liow  ca.ses  are 
piioritized  Howevei,  the  investigative  database  will  be  modified  to  include  a 
case  priority  field  in  otder  to  more  effectively  document  and  Hack  case  priority. 
Estimated  completion:  29  Apr  00. 
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Audit  Team  Members 


This  report  was  prepared  by  the  Deputy  Assistant  Inspector  General  for 
Audit  Policy  and  Oversight,  Office  of  the  Assistant  Inspector  General  for 
Auditing,  DoD,  and  the  Deputy  Assistant  Inspector  General  for  Criminal 
Investigative  Policy  and  Oversight,  Office  of  the  Assistant  Inspector 
General  for  Investigations,  DoD. 

Bruce  L.  Drucker 
Wayne  C.  Berry 

USAF  Lt.  Col.  Frank  G.  Albright 
M.  Joanne  Wallis 


